


Institutional Archive of the Naval Postgraduate School 


Calhoun: The NPS Institutional Archive 
DSpace Repository 


Theses and Dissertations 1. Thesis and Dissertation Collection, all items 


1988 


The implementation and execution of an 
internal control program in a Naval Shipyard. 


Stanovich, John M. 


http://ndl.handle.net/10945/23050 


Downloaded from NPS Archive: Calhoun 


| Calhoun is the Naval Postgraduate School's public access digital repository for 
D U DLEY research materials and institutional publications created by the NPS community. 
get Calhoun is named for Professor of Mathematics Guy K. Calhoun, NPS'‘s first 
KNOX appointed — and published — scholarly author. 





LIBRARY Dudley Knox Library / Naval Postgraduate School 
411 Dyer Road / 1 University Circle 


http://www.nps.edu/library Monterey, California USA 93943 


a 


en 


” 

















































































































































Ys 4 ah a 7 4 Oram ™ er oo © S ee 
i ek Ee th. Py ee r i“ 18466 tee rei egg? =i gate aif arr , 56% ntaasarse Mage nteRate RaBars Or BONe * oe 
ww sab ‘aay ab Mem hteltt yarns Rens igee’ 
iris par a ae Ps ih 9) ms REL, me pa yb Py tie ae oo tesa® Desens 
, ee ee Set oath ig 2 epee as foe acrrer So) pf. rae ooh a. et nicest 
A Ad re ra eo a % at ais o.tes tele we aay tiasase ace e 
z 4 ane a) ‘ Z tad AOE? Ap APS Om ouel sesnpae®. Boas eis 
by a A "nat ixpazstes 0g7 AB halt ie 00 lw Pe: 4 = ae a PGAG%s Se Os Arte 
vs ‘ te Ap pyar et wrt OOo thet as ge. emu Aaee Male te 
; ks temiee 0 tnligh nese ke aeadee fenee ve ATR. 8 OG 0 01174" apFOS AOL DBO 
F Pf ar i 4 02 A u ali ¢ Ca Eo ENE Ais be Clg a A 
oa A a ae 4 a ie Bay. Tafps. pe Felasiaa ane eta Ps —— antag Dah fae as PH ener agase? ee. vounpetses aa 
. : i ' yd - rz . ‘ 2 pa ee Ce i 
tye =| eer att fale ete han. rein SN tS ee vy a rea seh Was ate ne Canee. a, aa eeu se NS operons 
' ity witier al 4 ave re eee wee * a, 8. Rani tie - : septate, ee 19S rte’ . or oaraee. 
Ae Pay . Ric o4 +e hays ** Th irk? “he pes year sraan eats AAO fe 9b? phe dante geen De ameesel 
‘ io wee ait ° i ro ae Prot tir aie Tome ETC gee heard Sbeleastern 
e > . Figs a 3 7 P 
te Tg oe set ea shinai igcreu agen mune eased 
ee nr et gies Aas hata ictt hp eaten te arte th 
: Dog s gf Ot ee ‘ 20% Bp st*a: Ficosk ebsMo kn to =m BeReeseges! 
ay s i 3 Bec eh a ; rap nad. bees eric ers seid puarics-s- ee “a ‘likatiaitie te casein Bee 
' ' ‘ 1s a “a ® @ 
5 . Rie ‘ ‘ _ ie oe Haiesite aswa joa taxes. Asai e.e& ar nareapens! 8 aone 
: Pas , ros : fo: =e = ‘ ' T er} a Diy coi nate Ot SU Ve ey or eD a. “i 4 Dag e Bnet Sree ey mM a nsmenatts 
eS e " ". . ad ; Tee , Gtae age. ' ‘ue at voy mate arn ie? BAS 4-4 Mate. eaten 108 sa apebetet patos’: i RE spose ay 
. ’ rd A i ' tas ‘ : i 
ome Saba te EER Es & GAS nial ie eb aa Leena eae sears ama ences Pao Sandie srnaneatt 
PRE i oy ae ee. hs Jee | > AS Bee ned ngs 1 Maal poe Buse ke Te crue peaastsegnseeut 
™ * i H * Ah Soke 
Ae: F - ome *% Ca a foe.” a ate ah " Boeac pe Boat de aie pa abe apie ‘ cemeenns Maat p ase 38 Bet chute tat en asaheonateuneere ney 
. < 4 ‘y ’ 7 e rs qa ‘dal 4 r 4 antagoisee “s taehtacaon put fe asp? 0 Me abe tbh tos saad babs: if path iy eee ay 
U ieee ne t « Soest & 4 tg are Ab Wee ik sEAaK A Mat GREn: ep fees aaea.’ cae o mete Saat tivenssees ber 206 omen: ®, 
s ae ry 2, °° ae “a ieee wh tg) pid ated.F al Vb PST es a aan saat sence daa em a0 91266 
' e i> a a = Pa 29 yas 2 *e ' uw ' 
’ Oe : ea ar ws aay teal tr yoni ee s “tpg srierinn aan ® ert nett erred * sant “jefe steetens Sent tae pes 
: ‘ ; reer arate ft 7s ppade, Om Eagle? Soa 6 a ahs an Be tan A . parapdgee® 
: 1 So ee esate Cesar Sans eT AE tal rhe [piss ‘ sods: a caeragyirgee | teh gate rag saan whew Madensee gece oe eter sts 
‘ “es WNP Ale pases karte cas. Tenae# 42,4 *) jot ca GAs Asbo, 418 3 wah aye Eh ee atake banetenps 
"4 ta ah 4 y ne) ou nad, 42445010 snee = 1% Sie 1 Lapeer " ; Si 
r . F su a? be 10 @ rey 1 Mma Wasucts§. Nh Beate oe AN Ts Pee en fati phia Mahe ce abhatange cyet * i aa : 
i ra ' 1 ts it ‘ 
i ote us one e H fr. ° eh Ary ii et vl roe a _ ia St a qh fin pores ity ‘ pea Pauses Songer iia Mtoe 
x ae ahi Fy oi by! "AgKAts 
; com © r “ a e j 2 elt Q > ee ag > aby ne MP ‘yy. wacky tandn pape RN TTY ares a Hee Sr te tp vine mage sersars semen eg? 
; TL i 4 o,0 7 1g ' A etvol mabrarSei : art Ree 1g eee bee pe 
ey “ar ae he ‘an are nee % ile cae i wa 18 gi ers Sif B+ @rtg ee ee acta +) 
oes = r Py Te si 4 Ayko s ters 4 Bek eae? pe tgete Clad ad ont . , seni 9) 
rt s | ed t Aspvs oe = he ab a “ Pes’.: qn {! aga vy) rae ie siagaasgieens ere ee “ eb b 
cay : ‘ ; retgt Retsil. Bde a tae oY went see ceteseue atone seit ti tie oh * Sarayaees 0 ey ad tee lp 
1 .; a uw 4 pi of 1, fete me EPO 
> a ‘ : : 4 ? t at, 5 ay Fa 'ei Ne Pattgt hed tet 1, niae # iP cbt ae aye : : +m : Sate tigees eee aricungtere wag bo Og enn esaat © 
, eae ‘ sya? Seta ' » of | Oi. Liew tale piare ait es yk see aa es sega t34) ia Pobkp= ye AAD! ater ape parts aes ah 
Seay RMR SRC ean Gaia Nee stryepeO NE RN ue octet 
nan am 0 Fe i’ Re ay apa i te aye PAS “foaseg tg ose st fy t dae CA e Specs ogee ‘ 
. o4 4 ’ na vue So aA t LeishE cote MT lb ait Ae) aie reste th ora JRE gis See: ep DIegmesaes Bs 
; j ul Ys BS ms ne eas | ord. STi aah settee sgte § 2 TN ae ess ieee sain i. “ De prea ‘ae 
‘ u  . PP "me? Op wi. a % ‘esas Reape y Spare dutnd §. hs wits Oh ett awe rot Eas 4 scahel flier eps same sugoe Lh 
: nO 93 AT EOC a he ee 4 ea 2 f at ee sm) Plae 25 Ns ita baie Werder) 1 eae 
— i 7. +, if all - iy we koe. hy a Wingate ahead gage pH at at an tian priiere orn hes 7 ere * Mase -peheees een 
. ‘i BY a : “adthie: ? i ae Se #3 hr okt side te Paes ven e Bata ¢ es: geen saree 
; , ‘es : J? id lef o wae at rete aight ' eat bts 5 a Sas sh rene tee b af th eR 
a 2 ips ie, ; Me Basia ier, ful,a hacgg a ead te ates re 3 Ait ETT aelasente 387 nit shee ae ve 
gute ae Z f , ager te ee ' t Pye stat rae: Rae TTS “ss! wit ala ars : J pipet a fe ipetors pars aS oe 
. ‘ 2 a a ie ah ots oy ' L hees t 0 47am “5 
. et TROL OR a ES Sn eT a i os 4 sasuke’ pup geen es 
w ! ae eT a to Lee oer? Hep Sou gn. yogarnt JSORPY ah gse f : tne crass a seat Snpcigu am 23 re seta ws 
er es As a re . ro NN Y ahs nie Me fee ook tae Sasinee Ba ~. Mae . assy Wy Wegogm! Le touag steers eittageth 
i ‘ « 7 i" o or > 
2 CG SPARES gag doth ROBERT SR OS at ea a tras ee Bate Pe aaa inayat 
ia aR, , yA SCE balan eb cde we eapad va Nag og ty wih aN 18 8 mek fon sine ca rien 
a oe D , J j 3 <fias Pee art de AS, by ot Ua eas site me i 2 uae 4 apne peters Oe ay 
, i i 2? ty aT a? ae Alen oe 4 ee ae ; eae aan Pacer tial = wit st : i diag Sore GaN: si sate, 2-3 ueNtoy 81%, 
‘ s , Tadd aie bd 
: A al ye ah & 9, dat . r} ioe Sots me be Aggie * =38 To Cres ben Conte: a Angus . Meth ye : pa a0 
» 8 ye \ - ‘i i bi ents ig ga? As pare gh gts makes 8 nee SIN nos6 Sah Q A nae Sia agnee “Ah aa SR Cb g oes ‘anu Wan 
t e ' ¢ a The # ie 2 a ie “ah at ‘ nee Pies ni seh : a he ak WN. ~ Pag hie: \ohee 2af seein ae “pe ine ry ie Rees ithe tah PY 
ty ' . ' ye weg £2. ey ip oF a=W 
ane oa : * i] wats hte ° atin wy hy izky we Gee renietees i ie vt an ae 3 Peed oetar fe. hoop 
i te é ye te" te Ala wa! ie ke Te “ae Pe nat piee aa AS ag, bee ieee at 
; \ a a “ ty w a vatgige 2 * Cig Ae: ” Tady ph yee kegs UE - wwe A “5° a “4 ’ atten, ’ 
’ I ? - 4y '° en “ i nedes aa ae he Serene We i Te og ta dt aaa BI b Be Ns CRECL Fine ae a Saeeet — 
* re es he ids rr : ¥ i 4 } Sf 7 Agee biaphe.. Ug oH aes. SP ty tevtnett x ela \e5y 
same an Yet tas OF fishes w qi ry ies : av iar iy : c= 
. fa ’ p - feat - i. aa) pee Pre Ss vt A afin 4g 8 ai Oi Rulon yh eae ete 
‘ t ‘ = i i 
; . abn Re Ys Ee aS a tag pa eoAtty z. lets an ieee iy $ na fee ae = 
> bi ' ’ ‘e eee ayn : a oe ba os Mo% ~ aA oi tg a en Xe at a 
: 7 H Sn ia 
ey : > _ a +o ee Hed, sate ares ret BIT oo Ss a 2 Bir 
. e ° J * 
' ' ; Lelie “ ‘ eee ere 4 he a sale 0 ie soy ue ay Ray £ AS 
. ie e ’ I Tikes i 3 2. at Fe” « 4 
i i e rue on ‘s Paine ane Hedley 3 *aae hs 
ary a “ te  S ‘ << eho, PR Past i ie % 5 De 
' i - = cane aa sf * 0% a ot ae Bet spied Pe rie ops 
: 7 : ‘ i rh : aft ee 
: 7 ' Tins ts a be ep Se ereran ee *. 
8 t ene Gee i tee rie Sy diets 
. s i = h yt [. te Any} rt ye a a * Soup 
. ) : ‘ y eee 
: & v a3 #N,~ teas 
or . ears eet Gabe aia 
‘ : ‘ i gis? a ba a5 F 7 ong ves = ‘ 
Ah. ee f » y De *aides bane p i, Cea ag “204 ee Ns aa 
‘ i 49 % ; 2 ae & re oP . Sore trite yo) 
: : Cn : ; ' e ES ; sal i de reine “appr q. % i ete as re aay Sipser ee 7 
St Pe crag sible genes pune Kat RES Hoge Beireravts 
y p Par i ce 2 F y Wan ae 64d efig ht oho si $< sabia wer ‘ sueey ‘ 
G : - Pte” ofa +, att ie TR ot Achy th ities aR ings % GeCe Bae ans 
yf : kK 4 ‘ e 8 Fa Aim >’ ee mt ta Ma, “ete Pia: as a pes Tete se! ray tole : 
' ' r it 2% a a : ‘anes: fs 3: tagacs fs . 
5 ? _—s F cilia % i 1, tS ‘ oD ¢ ae fate? Pf Renee ty es Se ‘GG eae aR 54 
2 é . i — 2 Soe Py Ph 2, gneve Tie ee Liat ot pte wie 
até 7 # ! ~! 4 Po Uenar “4M Saat ‘ays Bi oy Slate 44th a ees Pio ri : pagtst mf % ct * 
t Sg a ‘ A i a sabe is, hes Xe Pye if Az. ‘F 5 RAN? ee ‘ seen Ast b 3 ae 4 dae; 7 sats 
' ' € -! - . set a a fat a] oi Wet eek, a Os s" 
4 8 ' : t 1 as — 4 ng a bE a oe aa peeiewas Ngee OF. sfc raft * fest fi 
ya 1g 4D Aida eh i syed Oe RT Rey OY abcs at's Ate pepe s. Laer 
oo _ oo, > ae? ERA TEES KG) mar aati AMR aa 5H Var A a “wp nears 
os y vee ie a tose ithe chen sie Gargs rea: la ete 
A re e : : “° 4 
ar; i : ae 2° ip? weet ae td adhe nyt gates! ta Sb 
im “ge ps te ig ote Saris Sa Ag wae 
; a i . eh F Cones aeerte’ ey i ake tis 
i 2 Ny i ry a > — 
see az 4 7 : 7 ° i a 4 f : eae fe. fo pas ne oer ake fs au. At 
ae ie , 7 re {a v2 mr : thr) Reus He ik ne oo iGer; :" 
; ee Fe! it >" : “4 “of oh gy ves STN ie ian ry ese is ‘ ug es Fi a AAs 
‘ ' ‘ : f WE x x, “A. 
‘ af —s cis ae GF: ite m phe Aste Lf tee ata 
i F 4 6 a ny ‘hs ae “Ye 63.3 vee REET gd Peet: 
i 1% 4 -.¢ $,! Pa ed ase pete apres eens nee cate 2 
’ owvh — * Aiea: 1s oe ‘et: are Recess ie 
“ ee) AF aad GEA Oa eee yarn ae 
3 1 . "y ow" a ys r 4 Rta erential at Fann tye ran OA i oe 
: ‘ Pe Ty 5” fhe ee aS f yer aun one si ony "5. et Pie Sane mee) ie ey 
’ | re > <7 2F o ~-~ 4 
> sale a ce We kee iam rileeadiss ates CURer gee eee 
' 1 ,2 at : y 1. Dy eftene ss pb a pe as i) 
ey: : ge radaias eqs; EAL ae ce, abated # 
‘ tt i é i ae "y a, Up iy Pe A 4 betes id évi eete eo mye tee 
' 2 . $ if UJ ri wn n> ¢ tries aey eda S04 Hib A lee 
Fa ce ai é : Le me oo vege 
' a a f : : ‘ iy eal ene. Ser eS a Ee fT eee ' : 
' ° 1 Py vente ve ay a 7 eye Genre) oN 
«en :0.8 v A . , pe i pret Fu ae Sa x AE pk te whe oy ee ei pa tate ee ior Es a 
~ goat 2 ; i : @ ee b be LG 3 wb gon Bow oa 
' . i yy Bs oe an ee te yhavs “ é dee al Tikes ee : ipoa tenes ad ahr, pirat A Bs Thy aes “teats 
ty os pr - 
Sg : ' | = Res i 0 Hs 3°, Mime ae * rks ak hee Poe reagan 
: ie : wwe GaSe cade "t Pade re P <: REE A ngteigie ns ees a ast 
1 ag: a ree “ = “8 . + : Sem: epagerers ? Pte BES 
; ; 4 ws ve ss Se gic) TREAT gi f= A aati Res a po tree +e 
U ps 5W. -F mar4.$ wi et i eye * : is Cee : red par eur Moe Ae sip ne) eto oie 
° ; i u i hd wt - vibe “ owe . . “y* be Sey. oe Lag! at ni? ys! : \ ei ketrcte . “ be inh 
F : ee vem 7 > r= er 1 oe fe “et “at, oe fae 9 ee Pe Re Stl ed eae 
; rae Sen A ented ales Ge sce tw enebchcicerneten foe oh 
. 1 on 4 sure i oot i a Be fA. “i Pi pel Foe at & 7 aaa s ho ite 4 7 ie Shae? ee = s 
‘ E “ee, “fyi TS pigtie Bata peter ys read! & 
7 A I x ; ; q I Se. - wreeett a b. rd . f suigesspatg eee ane ; +s" es et 2€ i spate |b is X 
i ae ; ” o° arr € oe 4 qage® ss oy #4 Htwel ae Fed ebgitey® queue weet it 4 pasa H one = mae nang | 
: so Oi aia ra Ley ii ee je iad OT ML ae 5 0 Cd te fad od J. aided Peg oommremren gt 3 
ao a i ; 6 \e “ he i Sie wT ne ” fad; t ae we a « Waal: Paes ares a7 er wr? isp nee ee) at sie ighontnt. PP Hy 
zs : “ * ae Pet: ¥ oe a) fs hee my fe ‘aigie ak Rade zat one se ag tee qa ee Fes poten Bee “ot ti etter Nn ix Ble 
hale <i ah a Pe * ie: H ‘ 4 Fo spree « yrednet av ft Pic we are tone Pet © owe og me F 
¥ Bag Male Ae of ae - e pragenvedr ie) i PB Seet ete CMa Re ar hiety tht Sib aceon bei eoretce oes rd ' 
7. @8 ‘ pe mon ins ryt: oe wn wi Sees mae me aft aka! ool aah a $ if ieey adocinoee ies oe rorreryeee ret! or 
' a - » gaoptre . ; eae ar - : we wt 3 o wens aed singh ctl 
Cg eee eee ae ries Ah eter Sr) sitiewahe?: steeds eat Seep rncstene etter ee 
~ = uu8 rf ve ; . - 
’ : y ee ae on “sy laa dyes epeesry eet OR as seat pilates ean sepa h go rap Pes nephene a So nitne ames 
e a ‘s I. oS s de i] wae? eS ehv~ sat yn Be ye ® a i ae ae i 
is ¥ ; % ofr St YH v4 ot eae oe rer aera pound ote 
> ome : ; : . eet a # vei Pl we prydoarsh r ae - a es 1 Ph neue ee: wae are vont one raat werees pyre Lapchrhot. ae woe er= Reds 
7M ae 1a hs ae este pe eee a eek hy emedgh corse ft ag setha z - i epinite etd ieee gp deere 
an wT ' a1 oT Ra ww tee = nes we Fa i te sage ” 3 marae rege Oe 
a . a a eta Fo TSI caedecr teed pre tmana eng Renee eras Sie Trercdereteatec en 
7 al . , . : : weds hen i . ‘i o tee" Gh spo 5 ares : a A # See 
cate y. Myll fans ae “on eomioalp emeimas ay ryan REG taney rr ect rem em eens scs 
= J Ae > vo we - se “sae ras ee apy dese owed Lahtole 94 Facet * cy Berens a ayn wee re Apt ey oe OO me gO Pee ayo 
. ’ e i Ar ores f setagtan G1 que Tere Pies Fors bereh its e es ne wn f tty ade at art om 0 A at PPR 
CW ina ad —,. em S dared p wed vem ET ESSA ANE BNSF Sur Pree ses ase Cop hetero nolge f 
pete % nw . ames 3 1 hn pee Squtr ytee ee ace at pieniete rane ae Feng 
1 ' i 2 : ee vO Pen PETC banice tat Parga ee hee pSone. lags PT ad pepe 
i > - seam OW fa i ie ree eg ay ove sere hae ad or 7 
, ° Po ' 3 ’ age ries Coa pei OTN bbe? e eae raya 6 o¢ : garner tnd 
a of « = *) “an ‘ Pa : a arret ey ~~ at et Pee enter PS Ree apr vegas tek = as ae M atadorse ied aarp inch et 
' Sine ‘ray= bide tev es pelle FE I ak yah papel pple ~if ioe pital sas eet mnern es ore scrak oars 
is ® 5 2 Vatg ee wes 1 Tre an ph ry ig aes alt Geceaibtes van ph arp ey Weteneerhce Be «ort 
a ‘ ote ‘ a" > bidy id af a wee 
Toy 0 rg SABLA Te "saga eats eet tele aa orae sGeyene 
‘ es. #« nS eae “pays © gst ersiors osha os bar a Paaquetered ep ates ape Nene Tn arcane ghee” eels ear e 
om ad eke i ‘ae Ss aw te ae ne 4g APU ey 'y? Shari eerpeee ited As e Ne an “pbaawre ee ey os aa ng Dh 
, 7 tthe Gee pe Eh didi ener PP | esis decorate at 4 ty Ap Dest wlah, pomp pie 3 ee. SSE geawecteomrne aera 
' . F a, tin <a ye Wee vas noah Par © gee ea Poy Hotes e, ited} % of res ge we prorarers? pees rf ae nae ¢ 
eee iid tee EES gga g Oe NS aly eh Great mae center edt gates Tien bo eer see 
fy, a. He re 5 tame WTB OTM + HST, eee ta poo byasas i Hy fer a fwrepaeproryt tt Nl won a pariatelgrrnece ve os 
’ . A\ 4 . eweK b> - 
i ' a he mange g in ware * sed erit rane Tobearopeae, pent $6 > 23 Sg asew ey sate oe siege mete ara pan pee 
Lv ' i * mpi 1 OR ON ey feet oben vonage petediye 24s Ae BERG TAF POUR SF at FT tok tall Tiitorecmestam eres 
: ' ' eae me eral iy Lies Fo OE iret It reseyre re oe ah 3 Sietgeee evpecnt pe mearnt es | esa! wera eles: <7 ar ato 
ee - o (oye am. a i 1 one . sab 
a _ ei ep re TEs ie aye Cates week ois vee eo vrres oe er ale te: Meatyereee Ba ee Gree maeevenees ptt 
I! é ‘ ba) go saat elas tan ee eteeomnyeres es ibatyeets cet nop ae nr peri Aeon arom cz ate 
’ : ' : oy" gant 1 yiwoe® + wage ole 
a Seam vera Oa Adeeeee a sor oulyip orn yiaes ikea wo en Sho wer ae's el Ore S Oe 
a ae age SRR oy wf? sentaed gaara, BAR ne Ah Sed ys ot Seay wrayns tay sae pacre Ede Sepetge paoaree meget 
: <i rhet * rie aM vy b ave ist ag ceed ten ge are ua rae go yee! VEO frediy-ye ¥0t0 any pomeeve 2 pores 2900 ut Go vier ee ean 
, i i : wrt ate ans Y Te pacetiiicte th nee Haverste Gig senha ay eee eghaat Paavo len ye Eee Oe arene ate 
‘4, : * Perera ender Anes pr ph ie okie weit Les St aie Lege patil eects Lp pial att —. 
: i % i "i = te Fear, eeciewe wtowtee'# oe eterno wane ag ol g waa partner wecennenmane ped ops pon eielpresen ada 
if ' T ts ' bs Caled 7 ve Q ' 
r ne ee e ye OTT chet) DU eet ae aie “fee abl Li pada Og ee Oe ee at ALMONTE ER Oe? Of STE OI prererat 
a re aN Tce Plat Se CARTE CRIMI PC LORN ae wee a ecsncee Wreteed-: LFF ert Pase™ bppiec eoeiaethep stan pt ee Acres ents aria 
z . ia vil Ue oo et ae ERT a ae ppd I pes vessee @ © Aecenyeer th PA: fe stent ee Uren auNegeyibn 9 Oed eats Vem ‘s 
ci ho (eat me oe rem reat 07 SY ig! ole yur earth tea ae weer wae 8 98 8 pe i ai hotiadt oe spear ne 
‘ ot = ed ; sf “ne can ais wae aun EL Foote eatryie ie ini eeaimenr Smear. Sous yete ee gape ay ete = ee Sire 
+g r TS Se pe se renters ny ae Coins Lemat COUT: eE spertyeees ae ve SAL aoa tania 7 rebate tr : Myaereearye™! 
-"} © mettre” © tees ApS «weep ponenamuytees (7) th & pcb ee bower jew rapabeclte fa Cenwren et es ar Nee even 
Pte hg 4 Bibs UT a get 2A Te Teter ean ane cept set eta rte en deee eer ee eran cae aie 
rae ose y 4 | wary gnats ards ye 7) oe Hi eee vat prt b 
* or : =~ ¥ ys youre th (ates? preter a sem aye! 
gh O by. or SMe nx Hoe ielidey A bi it ng te mcaier Qe Gey “TNTURTETIT S219 $88 dare ets Sa eic unenbye 44 Uren ma tetas “ 
a e) ' 1 ; e }: he ‘a * bi oid. dq ee Tila He rare rage een bbe hgnady eae Wier ot Irae kecdgraserayi hfe tite as gard vesese ey ase pol 
ba i‘ 4s ry Pe Medan kee 9029 40°97 pA are ee a supa, on er weet ey toreey Fee fu bdes-y spheein 2 
: i << OME 4 ne ony he Whe epee Bpeerr atte creimsnat SRaNgeeares Sets uss EK VeRO HID Te ae wand mat 
1 Oe ‘oe : th ai DO ereit ‘Bree A=erne [De r ee 
, A rer yin te ¥ | gady ges oA ree. cates FON OG eatery ain a Siena: s-wrece ven Oy re eceesinen rater rere e 
s ‘ $ lk ee ice lng oiling SS gous etek ae repryet mn Oye see ne Bee pie Ante 8 es prearnsher 44 Letregereatrscen 
é or «7% | ot i ae P+ yeh . oases! epee pr aiei we “a8 2 * pera ; aren eae Fee vere. 
i an am oe prays) oon ieee eter. pare A te gh nt Ph ah CAN Sears bien Sesteew | a wauris oocetnrets @ 
i . : ‘ ‘ jeer ee ou Je ad pit SR A are ek Kia Sa" TSE had ee er alee Lien paket ett arent 
£ rime i's Lt ll syne Te ai el Re seeped ris pe fei SEF oa Nyeconmae Tiper ay ev PUR OY Orb One be Ee sa aeacemere 7 
: ‘ 4 : fo nae noon gee eqeytr78 vA ee newer Bene Core te mespip nt sel = pre or: 7 
% 4 ‘ gt seate ff ye eae Be ene fc yates Srnan rs yeereree so yasae'g ite Bich bee et oat Pinkie ~pabap bot be iot SeeerT barr Pt 
' TAPES RT see gi towers . OD COMET NTE. EEF” ONE TO NS OPE AAT BF TUM Ot dons Apron none e erin 
ms 4 eerie o Sag ede BEBE OT Fee re grgg rao meee ICT FATETEN LN Ter or weg tes tthe epee aetna, 
a) I u be hee ey Th Nyse eh Nad ae ee od ede ag ye PA OVS OS POS 8 TOS pg anted Gunw Vouay ore 
SMe Aq, = Bhs fase + aa Deeks Pe lhory neve baa palo hah “PP a py propaga ig pak fal Lire apy rye nt 70 A ant 
r 4 ‘ fe ; we > s 
; * l= ; ‘ rad Eri wo \e wi F ce . ers a Ey wee (omeserapere vee panied ped fh" A se neveg ois aay aoe eon cl ttace 
rity ts snlins . a °* ; An ove ee “Vey prt eho? i 
ne - ° "s | : = ve eee watyt soo Fu ey tigaasrtrxce- ervwonatienssrce aecpanee pend nap ati te Led nom f2vin 90) ip tenn oen tee ‘ 
a et ‘ de } we ae Py ee en TY Ly sen NN ea aiay rl! VATE) “NO rants 444 ep haaee-at raetrek om any 6 adel ‘ 
er eciciins 1 eae pe Ritatbntk, Ren cdouiah omer ed ae neenetGes akan sopra dprere sioesaetacet 
' F oy wt 
. Toe jen oe sob plea ues ieee a doe he ee hae HEAR eT Brehm once sap ee Eee te eer algh gtr site ee aaigaaS 
: ae cot «ON abo see 1S pee Te rel k thre ene eT AT Se as A petty ner ee ery T. 














NAVAL POSTGRADUATE SCHOOL 
Monterey , California 











THESIS 


THE IMPLEMENTATION AND EXECUTION OF AN 
INTERNAL CONTROL PROGRAM IN A NAVAL SHIPYARD 


by 
John M. Stanovich 


June 1988 


Thesis Advisor: James M. Fremgen 





Approved for public release; distribution is unlimited 


aa os pa 4 a a 
Pit =) Cdenry 
r y ¢ } i 
j 4 Pf ; y 
BE aad 
ed 





Neh Aoo LP ILED 
EURITY CLASSIFICATION OF THIS PAGE 


f REPORT DOCUMENTATION PAGE 


REPORT SECURITY CLASSIFICATION lb RESTRICTIVE MARKINGS 


Me LASSIFIED 
SECURITY CLASSIFICATION AUTHORITY 










3. DISTRIBUTION / AVAILABILITY OF REPORT 
Approved for public release; 


DECLASSIFICATION / DOWNGRADING SCHEDULE distribution is unlimited 


| ERFORMING ORGANIZATION REPORT NUMBER(S) 5S MONITORING ORGANIZATION REPORT NUMBER(S) 


6b OFFICE SYMBOL 7a NAME OF MONITORING ORGANIZATION 


(if applicable) 
Code 54 





NAME OF PERFORMING ORGANIZATION 




















Naval Posta 
7b. ADDRESS (City, State, and ZIP Code) 


aval Postgraduate School 
/ ADDRESS (City, State, and ZIP Code) 








ionterey, California 93943-5000 Monterey, California 93943-5000 







9 PROCUREMENT INSTRUMENT IDENTIFICATION NUMBER 







8b OFFICE SYMBOL 
(if applicable) 


NAME OF FUNDING / SPONSORING 
ORGANIZATION 





_ ADDRESS (City, State, and ZIP Code) 10 SOURCE OF FUNDING NUMBERS 


PROGRAM PROJECT TASK 
NO NO 
TITLE (include Security Classification) 


ELEMENT NO 
HE IMPLEMENTATION AND EXECUTION OF AN INTERNAL CONTROL PROGRAM IN A NAVAL 
HIPYARD 
2. PERSONAL AUTHOR(S) 
Manovich, John M. 


a. TYPE OF REPORT 13b. TIME COVERED 14 DATE OF REPORT (Year, Month, Day) [15 PAGE COUNT 
laster's Thesis BROMO eee oe: F: ne O 


_ SUPPLEMENTARY NOTATION 

he views expressed in this thesis are those of the author and do not Ferlect the official 

rvolicy or position of the Department of Defense © the : overmmen 

ve COSAT! CODES 18 SUBJECT TERMS (Continue on reverse if necessary and eATIFy by block number) 

FIELD SUB-GROUP Internal Control Program; Internal Controls; 
eee) Shipyard 


9. ABSTRACT (Continue on reverse if necessary and identify by block number) 













WORK UNIT 
ACCESSION NO 









This thesis reviews the evolution of an internal control program from 
the Federal Manager's Financial Integrity Act through implementation by 
local line managers. Using interviews and a case study analysis of one 
shipyard’ S internal control program, a current picture of how the program 
is working provides evidence that the use of internal controls can make a 
difference when promoted throughout the entire chain of command. This 


thesis also reviews the elements of internal control and its history in 
the government and in the Navy. | 


20. DISTRIBUTION /AVAILABILITY OF ABSTRACT 21. ABSTRACT SECURITY CLASSIFICATION 
XJ UNCLASSIFIED/UNLIMITED (J SAME AS RPT C) DTIC USERS Unclassified 
a. NAME OF RESPONSIBLE INDIVIDUAL 22b TELEPHONE (Include Area Code) | 22c OFFICE SYMBOL 
ror. James. M. Fremgen Code 54Fr 
DD FORM 1473, 84 mar 83 APR edition may be used until exhausted. SECURITY CLASSIFICATION OF THIS PAGE 
All other editions are obsolete 2 U.S. Government Printing Office: 1986—606-243 


- UNCLASSIFIED 


Approved for public release; distribution is unlimited 


The Implementation and Execution of an Internal Control 
Program in a Naval Shipyard 


by 
John M. Stanovich 


Lieutenant Commander, Supply Corps, United States Navy 
B.S., University of Southern Mississippi, 1976 


Submitted in partial fulfillment of the 
requirements for the degree of 


MASTER OF SCIENCE IN MANAGEMENT 


from the 


NAVAL POSTGRADUATE SCHOOL 
June 1988 


ABSTRACT 


This thesis reviews the evolution of an internal control 
program from the Federal Manager's Financial Integrity Act 
through implementation by local line managers. Using 
interviews and a case study analysis of one shipyard's 
internal control program, a current picture of how the 
program is working provides evidence that the use of 
internal controls can make a difference when promoted 
throughout the entire chain of command. This thesis also 
reviews the elements of internal control and its history in 


the government and in the Navy. 
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a. BACKGROUND 

im private industry, the™ goal of the organization is 
often to maximize profit. The Federal Government does not 
have this simple a measure by which to gauge success or 
failure. However, the goal to maximize profit is based on 
two underlying principles that do relate to the operations 
performed by the Federal Government. Those two principles 
are efficiency and effectiveness. Efficiency is attained by 
minimizing waste in the generation of output, and 
effectiveness is attained by that ouput achieving the 
Federal Government's goals. To produce its output and 
achieve its goals, the Government must use resources. These 
resources are not unlimited and they are acquired through 
taxation of the people. When these resources are wasted or 
when the goals are not achieved, the people exhibit very 
strong concerns. They measure the success or failure of the 
Federal Government by their knowledge or perceptions of how 
goals are being accomplished and how resources are being 
used. Congress, sensitive to the needs and concerns of the 
governed, passed the Federal Manager's Financial Integrity 
Act of 1982 (FMFIA) (Ref. 1]. The Act was designed to 
increase the use of internal controls throughout the Federal 


Government (Ref. 2). A period of six years has elapsed 


Since that Act's passage and the Department of the 
Navy has implemented a program to meet the requirements of 


that Act {Retomoqe 


B. PURPOSE AND OBJECTIVES OF THE RESEARCH 

The primary purpose of this study was to examine the 
implementation and execution of the Navy's Internal Control 
Program at the local activity level. The first step in 
trying to achieve that goal was to select an activity that 
provided a wide diversity of functions with a high 
susceptibility to fraud, waste and abuse. A second step was 
to look for an activity that supported both operational 
forces and shore based facilities. The third and final step 
for selecting an activity was to find one that had a 
permanently assigned Naval Audit Service auditor. A 
requirement for an on-site auditor was felt to be necessary 
for obtaining an external evaluation of the local activity's 
performance regarding the use of internal controls. The 
only type of activity to meet all of the preceding 
requirements was a Naval Shipyard. Naval Shipyards are the 
only Navy shore activities that have permanently assigned 
on-site auditors. As an industrial activity of major 
importance, the shipyard has numerous functions which are 
representative of both Federal and private business 
activities. Some typical common functions are the sales 
cycle, the collections cycle, the manufacturing cycle, the 


purchasing cycle and automated data processing cycle. 


Because these cycles are commonplace this study may provide 
a sense of how a typical internal control program evolved 
and is currently being used to protect resources. One of 
the shipyard's primary mechanisms used to monitor the use of 
its resources is the Navy's Industrial Fund. The Industrial 
Fund is a revolving fund that is reimbursed through the 
purchase of services by its customers. Annual expenditures 
for the eight active shipyards during Fiscal Year 1987 was 
approximately $3.7 billion and expenditures for Fiscal Year 
1988 are projected to be $3.4 billion [Ref. 4]. 
The specific objectives of this thesis are to: 
(1) Identify the basic requirements of internal controls, 


(2) Trace the history of internal control in the Federal 
Government and the Department of Defense, 


(3) Identify the key individuals responsible for local 
implementation, 


(4) Identify the types of internal controls being used, 


(5) Evaluate the use of internal controls used to correct 
problems, 


(6) Describe the attitudes of the key individuals and 
their perceptions of the benefits of having an 
internal control program. 

C. SCOPE, ASSUMPTIONS AND LIMITATIONS 
This thesis was directed primarily toward a review of 
one shipyard's internal control program, with special 


emphasis on examining the specific controls used to correct 


actual or potential errors existing within that shipyard's 


functions. A major assumption for this study was that, if 
the shipyard had not implemented an internal control 
program, there would have been no other internal method 
developed to cause line managers to evaluate how efficiently 
or effectively their functions operate. The fact thames 
until after the passage of FMFIA, there were no records to 
document whether line managers were in the habit of 
evaluating their areas of responsibility was the basis upon 
which the previous assumption was made. Without an internal 
control program, it was assumed that the ability of the 
Secretary of Defense to certify the effectiveness of his 
department's internal controls would have been most 
aATEETCULE. 

This study was limited to on-site field work within a 
Single shipyard and all contacts with the Naval Sea Systems 


Command were made through the use of telephone interviews. 


D. STUDY DESIGN AND METHODOLOGY 

This study was designed to be accomplished in four 
phases. Phase one was a historical search of the applicable 
laws, instructions and reports that pertained to the Navy's 
eventual implementation of a formal internal control 
progran. The historical search for information was 
necessary in order to provide the basis for identifying the 
methods and measures needed to conduct phases two and three. 
Additionally, phase one was done so as to understand how the 


program evolved at the different administrative levels 


within the Department of Defense, which were responsible for 
executing the requirements of the Federal Manager's 
Financial Integrity Act of 1982. 

Phase two encompasses the selection, contact and 
preliminary survey of an appropriate local activity for 
field work. The selection of a shipyard was based on its 
representation of a wide variety of financial, support and 
production functions. Each of those functions have a 
significant potential for resources being subjected to 
fraud, waste and abuse. A shipyard 1S a good candidate for 
study because it has a significant impact on and interfaces 
with both operational and non-operational forces within the 
Navy. The importance for having that interface within this 
study 1S because all important shore activities exist in the 
Navy to support the Fleet. The more support a shore 
activity provides, the greater its importance to the overall 
mission of the Navy. Usually, the largest assembly of the 
Navy's assets are in direct support of fleet operations. 
The next part of phase two was to establish formal contacts 
with shipyard representatives. This part opened the 
channels of communication needed to gain access to records 
and line managers for conducting field work during phase 
three. The final part of phase two was a preliminary survey 
of the shipyard. A preliminary survey allowed for the 
opportunity to gain first-hand knowledge about 


organizational relationships and it allowed first-hand 


examination of records for determining the appropriate 
functions to be selected for the phase three case studies. 

Phase three focuses on the actual on-site field work. 
This field work was designed to identify the local program, 
obtain the requirements of that program, conduct interviews 
about the attitudes of the supporting organization and 
develop six case studies. The six case studies were used to 
examine specific examples of internal controls used to 
prevent material errors. 

Phase four, the last phase, deals with interpreting the 


results from phases two and three. 


E. THESIS ORGANIZATION 

Chapter I is an introduction. It explains the 
importance of internal controls and describes the goals and 
objectives for this study. The scope and research method 
were briefly discussed to provide a frame of reference for 
the information to be presented. 

Chapter II is a general description of what internal 
controls are and what things need to be considered when 
attempting to utilize internal controls for prevention of 
fraud, waste and abuse. 

Chapter III is a historical review of the applicable 
laws and circulars that established the requirements for the 
Federal Government's programmed use of internal controls. 

Chapter IV is a description and history of how the 


Department of Defense executed the requirements of the 


Federal Manager's Financial Integrity Act through the 
Headquarters Component level. Topics discussed are 
responsibilities, written gu’dance, vulnerability 
assessments, management control reviews, the internal 
control program's operational process, the Naval Audit 
Service's review of the program, and the General Accounting 
Office's analysis of the internal control progran. 

Chapter V addresses how ae shipyard developed and 
organized a local internal control program. 

Chapter VI examines how the Internal Control Program 
actually works and provides some evaluation on how the 
actual operation reflects the design intended by the local 
activity. 

Chapter VII summarizes the concluSions and 


recommendations supported by the field work. 


II. INTERNAL CONTROLS OVERVIEW 


A. INTRODUCTION 


Organizations, either profit or non-profit, consume 
resources to achieve their objectives. Examples of these 
resources include personnel, information and capital. 


Resources are used in event cycles which are "groups of 
related steps or actions within a program or function that 


are held together by a significant beginning and ending 


point." [{Ref. 5:p. A.3} Another term for an event cycle is 
a system. Although resources are essential, they are also 
scarce. Therefore, their consumption must be controlled. 


This is the purpose of an internal control system. 
This chapter will outline important definitions, 
objectives, standards, risk and compliance testing as they 


relate to the use of internal controls. 


B. IMPORTANT DEFINITIONS 
There are two definitions of internal controls relevant 
to this discussion. The first definition is from the 
Secretary of Defense's Internal Control Course. 
Internal Controls are operational checks and balances that 
prevent loss due to fraud, waste, abuse, and mismanagement 


of Government resources. Resources include: personnel, 
information, and capital. [Ref. S:p. 3] 


The second definition comes from the American Institute of 
Certified Public Accountants' (AICPA) Statement On Auditing 
Procedure 54. 
Internal control comprises the plan of organization and 
all of the coordinate methods and measures adopted within 
a business to safeguard its assets, check the accuracy and 
reliability of its accounting data, promote operational 
efficiency, and encourage adherence to prescribed 
managerial policies. This definition possibly is broader 
than the meaning sometimes attributed to the tern. ce 
recognizes that a "system" of internal control extends 
beyond those matters which relate directly to _ the 
functions of the accounting and financial departments. 
[Ref. 6:p. 234] 
The two definitions are similar in emphasis upon the 
protection of assetS or resources through the use of 
internal controls. This is the basis for the Navy's 
Internal Control Program [Ref. 3], and is also expressed in 
the Federal Manager's Financial Integrity Act of 1982 [Ref. 


ie 


C. THE OBJECTIVES OF INTERNAL CONTROLS 

Objectives are the desired outcomes of any internal 
control system. There are two levels of objectives: 
general and specific. Examples of general objectives, found 
in the definitions cited in the previous section, are 
safeguarding of assets or resources, promoting efficiency, 
promoting the reliability of data, promoting adherence to 
Management's policies and preventing fraud, waste or abuse 
in event cycles. These objectives are considered general 


because they apply to any event cycle. 


Specific objectives are developed from the general 
objectives. They relate general objectives to specific 
event cycles. For example, if a manager wants to safeguard 
cash in the cafeteria system, he may determine a specific 
objective to protect cash from theft during transportation 
from a cash register to the bank. The general objective is 
to safeguard an asset, and the specific objective is to 


safeguard cash during the collection event cycle. 


D. ELEMENTS OR STANDARDS OF INTERNAL CONTROL 
Internal controls are based on general and specific 

objectives. However, achieving those objectives depends on 
the internal controls having certain characteristics that 
cause them to operate in an effective manner. GAO has 
called these characteristics standards [(Ref. 9:p. 31], while 
academicians often refer to these characteristics as 
elements [Ref. 7:p. 273). Regardless of terminology, the 
following characteristics need to be considered: 

(1) Reasonable assurance, 

(2) Supportive attitude, 

(3) Competent personnel, 

(4) Control objectives, 

(5) Control techniques, 

(6) Documentation, 

(7) Records, 

(8) Authorization, 


(9) Separation of duties, 
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(10) Adequate supervision, 
nme Seccurity mmpRef. S:pp. 31-36] 
GAO recognizes the first five as general standards, and the 
remaining six are considered a subset of control techniques 
/Mmeeft. S:p. 30). To gain an understanding of the general 
versus the specific standards as recognized by GAO, the 
following illustrates the relationship. 
The general standards are the building blocks of an 
effective control system. If one block is missing, then 
the foundation will be incomplete. In other words, the 
ideal control system will meet all of the general 
standards. The specific standards apply to the control 
techniques used in an assessable unit. Some assessable 
units will not require control techniques in all of the 
areas reflected in the specific standard. Therefore, some 
specific standards may not be applicable to all assessable 
Mnits. (Ref. 8:p. 35] 
The assessable units mentioned in the last quote are the 
same as the event cycles discussed earlier [Ref. 5:p. A.1]}. 
The general and specific standards are explained in 
detail below to provide a background for subsequent 
discussions. 
1. General Standards 
a. Reasonable Assurance 
An internal control must provide the manager 
with the confidence that he or she is able to understand the 
methods employed by the internal control and that the 


internal control, as he or she understands its operation, 


reduces risk within an event cycle. [Ref. 8:p. 31] 


ia 


be. SUpportjve Attitude 
An internal control often involves ag 
interaction between management and workers. This standard 
places emphasis on the idea that an internal control works 
only if it is supported by all parties involved. (Ref. 8: 
Dee 31] 
c. Competent Personnel 
An internal control requires that the personnel 
involved in implementing that control have the knowledge and 
skills necessary to understand their assigned tasks and to 
support the internal control system. [Ref. 8:p. 32] 
a. Control Objectives 
Specific internal control objectives are 
developed for each event cycle so that internal controls can 
address the specific risks normally inherent in that event 
eyele. The objectives are developed by management before 
management develops its internal controls, because those 
objectives are needed to provide an idea of what is to be 
controlled within the event cycle. [Ref. 8:p. 32] 
e. Control Techniques 
Control techniques are the mechanisms by which 
internal controls achieve general and specific objectives. 
GAO calls these control techniques the specific standards of 
internal controls (Ref. 8:p. 32]. Those standards are 


explained in detail in the next section. 
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2. Specific Standards 


a. Documentation 
Documentation is a control technique that 
provides an independent source of information that will 
indicate if a transaction has been executed. Confirmation 
of information is done by comparing documents to records and 
other documents. To illustrate, tool issue documents are 
compared against tool inventory records to detect unrecorded 
issues. Use of this procedure in a tool room enables a 
Manager to detect if his procedures are being followed in 
recording of tool issues. [Ref. 8:p. 33] 
b. Records 
Recording transactions accurately and on a 
timely basis improves the reliability of records for audit 
and review. Records are useful as internal controls because 
they can be used to audit past transactions for problems or 
errors. For example, in a tool room inventory records are 
maintained to provide a history of receipts and issues. By 
using documents or records each transaction recorded on 
those inventory records can be checked for accuracy. 
Without the inventory records, a history of past 
transactions would not be available to detect actual or 
potential errors. [Ref. 8:p. 33] 
c. Authorization 
In the execution of transactions, evidence is 


maintained that all transactions are authorized by persons 


1:3 


acting within the scope of their authority. As part of the 
authorization process, transactions are checked to ensure 
that they conform to management's policies. To illustrate, 
tools are issued only to personnel whose names appear on a 
list authorized by the shipyard commander to use tools. An 
approval signature from the tool room supervisor is required 
before one worker can draw more than ten tools. {Ref. "Gaee 
33] 
dad. Separation of Duties 

Separation of duties means that one person is 
not allowed to control an asset or resource completely. As 
an example of this technique in a cash collection event 
cycle, the person collecting cash is not the same person 
keeping the accounting records; and the person keeping 
accounting records is not allowed to make the daily cash 
deposits to the bank. [Ref. 8:p. 33] 

e. Adequate Supervision 

To encourage workers to comply with management's 
policies and procedures, supervision provides the necessary 
guidance and visibility to prevent and correct errors. 
Adequate supervision depends on having a supervisor who is 
capable of assigning, reviewing and approving work. The 
supervisor must also possess the knowledge to provide 
training to subordinates. As an example, suppose an event 
cycle involves performing extremely complicated surgical 


procedures. Having a chief surgeon present when a new 
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interiaisuperstorming Ehat individual's first operation would 
be a good control. (Ref. 8:p. 34] 
f. Security 

Access to resources iS a security issue. Abe, 
prevent unauthorized access to a resource, management can 
use physical controls, such as locks, guards or fences; or 
it can use administrative procedures to check on the 
intended use of a resource and evaluate whether the resource 
should be withheld to prevent misuse. An example of an 
administrative security control is to have all requests for 
Classified material screened to see if the requestor has a 


valid need for the information. [Ref. 8:p. 34] 


E. THE ROLE OF RISK IN DETERMINING INTERNAL CONTROLS 

Since fraud, waste and abuse are always’ potential 
problems, a gauge of their impact is necessary to determine 
the degree to which preventive steps must be taken. Risk 
evaluation 1s a method for measuring the impact of those 
potential problems. As a measure of the degree of potential 
problems, risk can be defined in various terms, depending on 
what management is trying to accomplish. According to the 
Navy's Internal Control Program guidance, the only type of 
risk used to evaluate event cycles is normally referred to 
aS inherent risk [Ref. 5:p. A.3]. However, two types of 
risk are addressed in the field work of this thesis. Those 
two types are inherent risk and control risk [Ref. 7:p. 


Bara) The Navy guidance on internal controls considers 


LS 


control risk as part of the evaluation of the overall 
inherent risk in event cycles [Ref. 8:pp. 31-47]. 

Inherent risk measures the manager's or auditor's 
expectation that material errors exist in the event cycle, 
before considering the effectiveness of internal controls. 
Control risk measures the manager's or auditor's expectation 
that material errors in an event cycle will not be prevented 
or detected by the internal control system. [Ref. 7:p. 244] 

Risk is not only an important management decision for 
evaluating internal controls, but it is also a key aspect to 
performing vulnerability assessments [Ref. 8:p. 3]. 
Vulnerability assessments are used as part of the Navy's 
Internal Control Program and are discussed later. 

Risk iS usually evaluated on a scale from high to low. 
But risk is not the only concern for managers. Internal 
controls have a cost associated with their use. That cost 
requires managers to consider how many internal controls 
should be used to reduce risk in an event cycle. To make a 
decision about the appropriate number of internal controls, 
the manager considers what level of risk 1s acceptable. The 
level of acceptable risk on a scale from high to low is 
determined partly on the basis of another factor, Known as 
Materiality (Ref. 7:p. 230]. Materiality is the relative 
Significance of some quantity. Thus, if a person had only 
two dollars and lost one, that individual would consider the 


loss to be material. However, if a person had $1 million 
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and lost one, that individual most likely would consider the 
loss to be immaterial. Combining risk and materiality in 
the following example will illustrate why both factors are 
to be considered before implementing internal controls. In 
printing two dollar advertisements for a newspaper, a 
printer mistypes half of all advertisements daily. The risk 
of printing errors is very high. However, the revenues 
generated from selling two dollar advertisements represent 
less than one percent of the entire revenues generated by 
the newspaper on a single day. The cost of the errors to 
the newspaper is immaterial. The newSpaper manager knows 
that, in order to lower the error rate, he must hire an 
additional printer, whose daily salary would be more than 
the revenues generated by the daily two dollar advertise- 
ments. If a manager considers only risk and not 
materiality, he or she may implement controls that are 


mmroetive but not efficient. 


F. COMPLIANCE TESTING 

Once internal controls are designed and put into 
operation, they should be tested to ensure that they are 
meeting the specific objectives [Ref. 7:p. 316]. This is 
usually done through compliance testing. Compliance testing 
can be done in these three ways: observation of the event 
cycle to see if the internal controls are in place and 
working, inquiry of the workers using the event cycle to see 


if they understand and use the internal controls, and 


Ly, 


examination of documentation to see if internal controls 
were designed and have been used [Ref. 7:p. 77]. 

Compliance testing was important for this study because 
it was used to determine if the internal controls 
implemented by a shipyard manager were effective in 
preventing identified weaknesses and if the internal 
controls were used as claimed in reports to superiors. 

An example of how compliance testing relates to internal 
controls iS presented in a simple shipyard event cycle. 
Distribution of office supplies is an event cycle that 
starts when a worker needs materials. The worker then goes 
to a place where supplies are located and draws’ the 
materials needed. At the point when the office supplies are 
issued or drawn, the event cycle is completed until office 
Supplies are needed again. A manager notices that the use 
of office supplies has gone from a minor expense, a few 
hundred dollars a quarter, to a major expense of many 
thousands of dollars. The manager knows from experience 
that workload and personnel have not changed for many years. 
This manager considers the change from a few hundred dollars 
to a few thousand dollars to be a material difference. 
After investigation of the event cycle, the manager is 
unable to determine why there has been such a change in 
office supply expenditures. The manager realizes that there 
are no internal controls over the distribution of office 


supplies. All of the employees have access to the storage 
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area, and there is no documentation supporting removal of 
office supplies. One of management's general objectives is 
to safeguard assets and resources, and in this case it was 
not being done. The manager decides to implement some 
internal controls. The specific objective is to control the 
issue of office supplies in order to reduce expenditures. 
The internal controls chosen are as follows: 

(1) Lock up all office supplies, 

(2) Appoint an office supplies custodian, 


(3) Require all issues be documented by a requisition, 
and 


(4) Require the custodian to record all issues daily ona 
issue summary sheet and forward that record to the 
manager. 

After the internal controls were implemented, the 
Manager notices no change in the following quarter in 
expenses for office supplies. The manager had not followed- 
up on the internal control system to ensure that it was 
working. When the manager finally investigated the new 
system, the manager found that the custodian was leaving the 
door unlocked during the day. Employees were going in and 
getting whatever they wanted. 

During the investigation of the problem the manager 
performed compliance tests. First, the manager observed how 
the office supplies were being issued. Then, the manager 
asked the custodian if the door to the supply room was being 


kept locked. Next, the manager asked other employees how 


they got their supplies. Finally, the manager reviewed the 
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requisitions kept by the custodian and compared those 
requisitions to the custodian's record summarizing daily 
issues. By using compliance testing's simple methods of 
inquiry, documentation and observation, the manager was able 
to find out where the internal controls failed to operate. 
The manager then decided to add one more control. The 
manager planned to conduct surprise spot checks to see if 
the supply room was being kept locked. 

The previous example shows how compliance testing is 
useful for determining if internal controls are in place and 
working. During the field work for this study, this method 
was used to check whether internal controls were actually 


making changes within the shipyard. 
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JE IEA THE HISTORY OF INTERNAL CONTROL 
IN THE FEDERAL GOVERNMENT 
A. INTRODUCTION 
This chapter traces the history of internal controls 
from their beginnings in the Federal Government through the 
passage of the Federal Managers' Financial Integrity Act of 
1982. Of importance in this historical review is the 


relationship between accountability and internal controls. 


B. THE BUDGET AND ACCOUNTING ACT OF 1921 

The Budget and Accounting Act of 1921 is significant 
because it is the precursor to the Budget and Accounting 
Procedures Act of 1950. It established several positions in 
the Federal Government that would ayenrail be responsible 
for enforcing the use of internal controls mandated by the 
mee act. [Ref. 10:pp. 20-27]. The 1921 act was passed to 
provide for a national budget system and for the independent 
audit of government accounts by an independent office. The 
independent office is the General Accounting Office (GAO), 
headed by the Comptroller General of the United States. The 
Federal audit function was removed from the Treasury and the 
office of the Comptroller of the Treasury was abolished. 
The budgeting function formerly performed by the Comptroller 
of the Treasury was assigned to a new Bureau of the Budget. 


This bureau would eventually become the Office of Management 
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and Budget in 1970. Separation of the budget and accounting 
functions 1S a significant event because it started to 
formalize a basic element essential in any good internal 
control system, the separation of duties. [Ref. 10:pp. 20- 
23] 

The key aspects of the Budget and Accounting Act of 1921 
are the formalization of accounting documentation for audit 
purposes and the reporting of financial information to the 
Congress and the President for budgeting purposes [Ref. 10: 
DDO =-20)), Congress was concerned that the data necessary 
for the Federal Government to budget accurately and then to 
use appropriated funds efficiently were not being 
maintained. Congress stated that the submission of budget 
information by the President could not be evaluated 
adequately, when the budget and accounting functions were 
consolidated under the Treasury; so, they created the 
General Accounting Office to be an independent check on the 
executive branch of the government [Ref. 10:p. 23]. Within 
its charter, the General Accounting Office is charged as 
follows: 

(a) The Comptroller General shall investigate, at the seat 
of government or elsewhere, all matters relating to the 
receipt, disbursement, and application of public funds, 
and shall make to the President when requested by him, and 
to Congress at the beginning of each regular session, a 
report in writing of the work of the General Accounting 
Office, containing recommendations concerning the 
legislation he may deem necessary to facilitate the prompt 
and accurate rendition and settlement of accounts and 
concerning such other matters relating to the receipt, 


disbursement, and application of public funds as he may 
think advisable. In such regular report, or in special 
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reports at any time when Congress is in session, he shall 
make recommendations looking to greater economy or 
efficiency in public expenditures. 


(b) He shall make such investigations and reports as shall 
be ordered by either House of Congress or by any committee 
of either House having jurisdiction over revenue, 
appropriations, or expenditures. The Comptroller General 
shall also, at the request of any such committee, direct 
assistants from his office to furnish the committee such 
aid and information as it may request. 
(c) The Comptroller General shall specially report to 
Congress every expenditure or contract made by any 
department or establishment in any year in violation of 
law. 
(da) He shall submit to Congress reports upon the adequacy 
and effectiveness of the administrative examination of 
accounts and claims in the respective departments and 
establishments and upon the adequacy and effectiveness of 
departmental inspection of the offices and accounts of 
fiscal officers. 
(e) He shall furnish such information relating to 
expenditures and accounting to the Bureau of the Budget as 
it may request from time to time. [Ref. 10:pp. 20-27] 
The Comptroller General performs the duties listed above 
through internal audits, investigating all matters relating 
to the use of public funds [Ref. 10:p. 25]. 

Internal audit is a function that addresses both the 
accountability concerns of the Congress and the 
effectiveness issue with respect to public resources. 
Internal audit is a necessary part of the internal control 
process because, without it, the ability of an auditor to 
detect material errors is significantly reduced. The vast 
size of the Federal Government makes audit of every 
transaction expensive; therefore, the auditor must evaluate 


the internal controls within its accounting systems. 
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In summary, the Budget and Accounting Act of eeeas 
established formalized accounting systems, required internal 
audit within executive agencies, established the Bureau of 
the Budget, established an independent audit agency (GAO) 
under the Comptroller General, separated the disbursement 
and accounting functions within the executive branch of 
government and was the first federal act to emphasize 
adequacy and effectiveness of offices and accounts (internal 


COntCro lL) 


C. THE BUDGET AND ACCOUNTING PROCEDURES ACT OF 1950 

The Budget and Accounting Procedures Act of 1950 amended 
the 1921 act and established the requirement to document 
accounting systems used within the Federal Government. 
While the 1921 act laid the foundations for internal control 
systems within the Federal Government, it did not 
specifically delineate the types of accounting systems nor 
did it use the specific words "internal control." The 
latitude and methods of execution were left to the 
discretion of the executive agency heads. The only real 
requirement for an accounting system's acceptance was to 
pass the adequacy and efficiency tests of the Comptroller 
General. The ever increasing size of the Federal 
Government, especially after World War II, dictated that the 
methods of communicating financial informationmae 
standardized and integrated throughout the Federal 


Government [Ref. ll:p. 835]. Congress was the defender of 
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the purse and demanded better explanations for the executive 
department's financial requests. Both the Budget and 
Accounting Act of 1921 and the Budget and Accounting 
Procedures Act of 1950 cited budgeting as the principal 
concern that motivated passage of the Law. 

Although budgeting was the primary interest, Congress 
established that internal controls would make the budgeting 
and expenditure of appropriated funds more effective [Ref. 
misp. 836}. More definite guidance regarding internal 
controls was provided in three areas. First the Bureau of 
the Budget was directed to 

...develop programs and to issue regulations and orders 
for the improved gathering, compiling, analyzing, 
publishing, and disseminating of statistical information 
for any purpose by the various agencies in the executive 
branch of the Government. [{Ref. 11:p. 834] 
Second the Comptroller General was directed to coordinate 
between the Bureau of the Budget and the Secretary of the 
Treasury and establish an integrated and standardized 
accounting system within the Federal Government. Finally, 
the heads of executive agencies were required to 
establish and maintain systems of accounting and internal 
control designed to provide (1) full disclosure of 
financial results of the agency's activities; (2) adequate 
financial information needed for the agency's management 
purposes; (3) effective control over and accountability 
for all funds, property, and other assets for which the 
agency iS responsible, including appropriate internal 
audit; (4) reliable accounting results to serve as the 
basis for preparation and support of the agency's budget 
request, for controlling the execution of its budget and 
for providing financial information required by the Bureau 


of the Budget under section 213 of the Budget and 
Accounting Act, 1921. ([Ref. 1ll:p. 836] 
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This three pronged approach was to provide greater control 
and better dissemination of financial information within the 
Federal Government. [Ref. l1i:p. 832] 

Even though Congress had provided greater guidance 
concerning accounting and the need to use internal controls, 
latitude for the execution of those functions was still 
vested in the executive agency heads and the Comptroller 
General. The Comptroller General was directed to determine 
the extent to which accounting and related financial 
reporting exercised adequate financial control over 


operations [Ref. 1l:p. 835]. 


D. THE FOREIGN CORRUPT PRACTICES AGU eRe lye 

The Foreign Corrupt Practices Act of 1977 was Congress! 
first legislative action to establish the requirement for 
maintaining a system of internal accounting controls. This 
act amended the Securities Exchange Act of 1934. Public 
companies were the target for this important legislation, 
but the significance of its passage lies in the fact that 
Congress acknowledged that internal controls could and 
should be used for preventing abuses of an organization's 


resources. fRef. 12] 


Bs THE INSPECTOR GENERAL ACT OF =lo7. 
With the Carter Administration's promise to reduce the 
size of the Federal Government, the pressure on Congress to 


become more accountable, economical and efficient 
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intensified. Congress desired a more active role in the 
budget execution process and copied the lead taken by the 
Department of Health Education and Welfare (HEW). In 1977, 
HEW was the first federal agency to establish an Inspector 
General position. [Ref. 13] 

Congress, by establishing the Office of the Inspector 
General, could ensure that each agency had an independently 
Gedicated party to carry out the functions of internal 
puadit, investigation. and control. Additionally, this 
position would provide a focal point for compiling data to 
report to Congress on the effective and efficient operation 
of executive agencies. [Ref. 14] 

Besides requiring the appointment of an Inspector 
General, Congress went a step further to improve 
accountability within the Department of Defense. Section 8 
of the Inspector General Act required the Secretary of 
Defense to take several actions. First, the Secretary was 
required to submit semiannual reports to Congress on the 
results of audit and investigations within the Department of 
Defense. Next, he was required to make public disclosure of 
audit results unless the results affected national security. 
Additionally, Congress also required the Secretary of 
Defense: (1) to submit proposed legislation to establish 
appropriate reporting procedures concerning the audit, 
investigative and inspection activities of the Department of 


Defense, (2) to establish a task force to investigate ways 
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to reduce fraud, waste and abuse, and (3) to issue a report 
summarizing the Inspector General's ability to work 
effectively and independently. [Ref. 14:p. 1105] 

The Inspector General of the Department of Defense was 
not to become the head of each military department's 
independent audit function. Each service secretary was 
authorized to retain authority, direction and operational 
control over his or her internal audit and internal review 
organizations. For the Navy, the position responsible for 


internal audit was the Auditor General. [Ref. 15:pp. 2-3] 


Ps OFFICE OF MANAGEMENT AND BUDGET CIRCULAR A-123 

The Office of Management and Budget (OMB) issued 
Circular A-123 on 28 October 1981 as an attempt to move the 
executive agencies toward compliance with the Budget and 
Accounting Procedures Act of 1950. Circular A-123 required 
agencies to: (1) establish directives on internal control, 
(2) make assessments of an activity's inherent risk for 
fraud, waste and abuse, and (3) develop a review schedule 
for internal controls. [Ref. 16] 

The significance of Circular A-123 lies in the fact that 
this was the first Presidential sponsored document requiring 
the use of internal controls to combat fraud, waste and 
abuse. Circular A-123 was later revised in 1983 to reflect 
the changes caused by the Federal Managers' Financial 


Integrity Act of 1982 [Ref. 16]. It outlined the use of 
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vulnerability assessments and internal control reviews as 
the basis for using internal controls within the Federal 


Government. 


G. THE FEDERAL MANAGER'S FINANCIAL INTEGRITY ACT OF 1982 
The Federal Manager's Financial Integrity Act of 1982 
(FMFIA) is the result of a combination of two bills that the 
House of Representatives and the Senate tried to pass in 
1980. They were the Financial Integrity Act of 1980 and the 
Federal Manager's Accountability Act of 1980. [Ref. 17] 
1. Details of Major Importance 
Within this legislation, there are seven important 
details that have brought internal controls to center stage 
in combating fraud, waste and abuse. Each is discussed in 
detail below. 
a. Internal Accounting and Administrative Controls 
Each executive agency is required to establish 
internal accounting and administrative controls in 
accordance with standards prescribed by the Comptroller 
General and shall provide reasonable assurances that, 
..-Obligations and costs are in compliance with applicable 
laws; funds, property, and other assets are safeguarded 
against waste, loss, unauthorized use, Gg 
misappropriation; and revenues and expenditures applicable 
to agency operations are properly recorded and accounted 
for to permit the preparation of accounts and reliable 


financial and statistical reports and to maintain 
accountability over assets. (Ref. l:p. 814] 
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b. Evaluation Guidelines 
The Director of the Office of Management and 
Budget, in consultation with the Comptroller General, shall 
establish guidelines for agencies to follow to ensure their 
internal accounting and administrative controls conform with 
the intent of this act. 
c. Compliance Statement 
Annually, executive agency heads are required to 
submit a statement of compliance or noncompliance in 
relation to this act. 
dad. Report 
Along with the annual compliance or noncompli- 
ance statements, executive agency heads will prepare a 
report that states exactly any material weaknesses in tne 
agency's systems of internal accounting and administrative 
control. This report will also contain a detailed schedule 
outlining the plan for corrective action. 
e. Transmission of Statements and Reports 
Each executive agency head will sign the 
statements and reports and forward them to Congress and the 
President. In addition, these reports will be made 
available to the public upon request. 
f. Appropriations 
The President will submit with each budget, to 
Congress, a detailed report explaining the funds requested 


on behalf of the Office of the Inspector General. 
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g. Agency's Accounting Systems 
Each annual statement prepared shall include a 
separate report on whether the agency's accounting system 
conforms to the principles, standards and related 
requirements prescribed by the Comptroller General. [Ref. 1: 
p. 814] 
2. The Role of the Office of Management and Budget 

The Director of the Office of Management and Budget 
is tasked with assisting the President by developing 
efficient coordinating mechanisms to implement legislative 
enactments. By so doing, the Director is responsible for 
interpreting this act for other executive agencies to 
follow. This act specifically identifies the Director by 
title and it tasks that individual to take the appropriate 
actions Congress felt were ignored by the Executive Branch 
when the Budget and Accounting Procedures Act of 1950 was 
passed. (Ref. lip. 814] 

3. The Role of the Comptroller General 

Congress tasked the Comptroller General in the 
Accounting and Auditing Act of 1950 to standardize and 
integrate federal accounting systems and then to approve 
those systems. In the 1982 act, Congress re-emphasized this 
approval requirement and mandated that agencies seek out the 


Comptroller General's approval. [Ref. l:p. 814} 
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Ae The Role of the Inspector General 


It appears that Congress clearly believed that the 
Executive Branch was not providing sufficient resources to 
the Offices of Inspectors General. By making the Executive 
Branch detail budget submissions in this area, Congress 
ensured that the Executive Branch allocated adequate 
resources to allow the Inspector General to be free from the 
power of the purse held by the entity being audited or 
inspected. [Ref. l:p. 814] 

5. summary 

The FMFIA is the most extensive attempt by Congress 
to date to hold the government accountable to the people. 
Internal controls and accounting systems were given 
standards by which progress in these areas could be 
measured. Reporting requirements made specific individuals 
accountable for instituting adequate internal controls. 
Internal controls have been made an important part of the 


way the United States Government conducts business. 
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ite clloweny OF INTERNAL VCONTROLS WITHIN THE NAVY 


f= INTRODUCTION 

The purpose of this chapter is to describe the evolution 
of the internal control program within the Department of the 
Navy from its start in 1982 through its current state of 
operation in March of 1988. To accomplish this purpose, 
there are five facets that are discussed to provide a 
general description of how the FMFIA was implemented within 
the Navy. Facet one describes the internal control program 
guidance issued by the levels of command responsible for 
complying with the requirements of FMFIA. Facets two and 
three describe the importance of vulnerability assessments 
and management control reviews, respectively, and their 
relationships to the internal control program. Facet four 
provides an overview of how facets two and three are 
integrated into a process that forms the basis of the Navy's 
Internal Control Program. Finally, facet five summarizes 
the comments of the Naval Audit Service's latest review of 


the internal control program. 


B. INTERNAL CONTROL PROGRAM GUIDANCE AND RESPONSIBILITIES 


1. The Secretary of Defense (SECDEF) 
As discussed in Chapter III, the FMFIA required that 


the Comptroller General prescribe internal control 


standards, OMB establish internal control guidelines, audit 
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findings be promptly resolved and Agency Heads certify and 
report on the use of internal controls within their 
respective agencies. It is with regard to those certifica- 
tion and reporting requirements that the SECDEF was assigned 
responsibility by law for establishing the use of internal 
Controls ~Ret al pao 4a 

The SECDEF, as the focal point for providing those 
certifications and reports, established the internal control 
program when he signed the Department of Defense (DOD) 
Directive 7040.6 on 24 March 1982. This implementing action 
was done prior to passage of FMFIA. Actually, the internal 
control program was started in response to an Executive 
Order, OMB Circular A-123 [Ref. 17:p. 23]. On 16 July 1984, 
DOD Directive 7040.6 was reissued as DOD Directive 5010.38. 
The change from the 7000 series to the 5000 series was made 
to remove the guidance from SECDEF's audit-related 
directives and to change it to a series reserved for 
internal review-related directives. This new directive 
incorporated the specific changes brought about by the FMFIA 
and the subsequently revised OMB Circular A-123 of 1983. 
[Ref. 17:p. 23] 

With the issuance of the original directive, SECDEF 
directed each of the military services to establish internal 
control programs within their departments. This initial 
guidance was tailored from the OMB Circular A-123 issued in 


October of 1981 and the OMB Guidelines published in December 
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of 1982. Because of the relatively short time between the 
passage of FMFIA and its required implementation, SECDEF did 
not immediately provide training or instruction on how these 
programs should be structured; the responsibility was left 
completely to the service secretaries. The GAO on 1 May 
1984 issued a report to the SECDEF that highlighted the 
progress DOD had made toward implementation of FMFIA. [Ref. 
18:p. 1} Within that review, two significant problems were 
highlighted. The first problem was that there was 
insufficient training on the requirements of FMFIA. The 
second problem emphasized that throughout the DOD 
insufficient documentation was maintained concerning the 
implementation of the internal control program. [Ref. 18:p. 
1} In August of 1984, SECDEF issued a training course that 
was designed to correct the lack of training and adequate 
documentation. [Ref. 19:p. 1] This Internal Control Course 
fRef. 19] comprised three volumes and a cover letter. 

With the directive and the training course issued, 
the SECDEF left the operation of the internal control 
program to the service secretaries except for overall 
compilation of reports and certifications to Congress. The 
remainder of this thesis deals with the internal control 
program as it was implemented within the Department of the 


Navy (DON). 
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2s The Secretary of the Navy (SECNAV) 


On 29 July 1983, SECNAV took his first formal action 
to implement the requirements of FMFIA, OMB Circular A-123 
and DOD. Directive 7040.6 (Ref. (7 -peees The result of 
that action was SECNAV Instruction 5200.25 That 
instruction became the basic policy guidance which started 
the Navy's Internal Control Program, directed use of "OMB 
Guidelines" for the evaluation, improvement and reporting of 
internal control systems, and assigned specific actions 
throughout the chain of command. [(Ref. 3:pp. 1-4] 

SECNAV Instruction 5200.35 has been updated only 
once since 1983 and it is currently issued as SECNAV 
Instruction 5200.35A, dated 17 May 1985 [Ref. 20]. The 
instruction was reissued so as to address three objectives 
not specifically covered within the first instruction [Ref. 
ET Dice ee Sale To summarize those reasons for change, the 
original instruction did not adequately emphasize the needs 
tO: 


(1) maintain effective operation and accounting control 
systems, 


(2) maintain involvement by all levels of management for 
ensuring that effective controls exist, and 


(3) maintain an adequate system to ensure that follow-up 
actions are in place to promptly correct internal 
control deficiencies. [Ref. 20] 

Prior to the Comptroller of the Navy becoming the 


Assistant Secretary of the Navy for Financial Management, 


the original SECNAV instruction assigned the internal 
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control program's project management to the Deputy Under 
Secretary of the Navy for Financial Management. He was 
supported in that function by the Comptroller of the Navy 
PRef. 3:p. 3}. SECNAV Instruction 5200.35A, the revision of 
the original SECNAV instruction, assigned the internal 
control program's project management to the Under Secretary 
@ft sthe Navy (Ref. 20:p. 2]. 

Currently, there is a draft revision to SECNAV 
Instruction 5200.35A that would shift the program management 
responsibility entirely from the Deputy Under Secretary of 
the Navy to the Assistant Secretary of the Navy for 
Financial Management (NAVCOMPT). Additionally, that 
revision emphasizes the need to have all levels of the DON 
comply with GAO standards and to involve all the levels of 
Management on an on-going basis in the process of 
determining adequacy of internal controls. [Ref. 17:p. 25] 

3. Commander, Naval Sea Systems Command (NAVSEA) 

Originally, the next echelon for implementation, 
geeeraqing to SECNAV Instruction 5200.35, was the 
headquarters component level and NAVSEA was designated as 
one of the original 26 so designated [Ref. 3]. However, 
when the revised SECNAV Instruction 5200.35A was issued in 
1985, the Chief of Naval Operations (CNO) became the only 
headguarters component beside the Commandant of the Marine 
Corps to report on internal controls directly to NAVCOMPT. 


Also, the revised instruction stated that the CNO was 
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responsible for ensuring that all his subordinates complied 
with the guidance within the revised SECNAV instruction 
[Ref. 20:p. 2]. NAVSEA as a subordinate of the CNO reports 
to NAVCOMPT through the CNO [Ref. 20:encl. 2]. 

On 6 January 1986, the CNO issued OPNAV Instruction 
5200.25A, applicable to all Naval activities. That 
instruction contained information similar to SECNAV 
Instruction 5200.35A but had two requirements that were not 
Similar to the previously issued guidance. OPNAV 
Instruction 5200.25A identified a detailed inventory of 
assessable units that were to be included periodically for 
vulnerability assessments, and it identified CNO's demands 
for specific reporting requirements. [Ref. 17:p. 26] 

NAVSEA, within five months of the CNO's issuance of 
OPNAV Instruction 5200.25A, issued NAVSEA Instruction 
5200.13 “Ref ez ie Under this specific guidance NAVSEA 
provides the internal control program policy for the Navy's 
eight active Naval Shipyards. This thesis focuses on the 
internal control program implemented within one of those 
e€ight shipyards. According to that shipyard's Director of 
Internal Review, the shipyard commander identified NAVSEA 
Instruction 5200.13 as the most important guidance to be 
followed for implementing the shipyard's internal control 
program. Since NAVSEA Instruction 5200.13 is identified as 


the most important guidance for the shipyard to use in 
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developing an internal control program, the important parts 
of that instruction are quoted below for future reference. 


1. Performance Appraisals. The ability of personnel 
assigned duties to develop, implement or maintain internal 
controls or to perform Vulnerability Assessments or 
Management Control Reviews should be evaluated in their 
routine performance appraisals. 

a. Military Personnel. The internal control program 
does not reorient the current military fitness report or 
performance evaluation process. Rather, the normal 
appraisal process continues to review a military member's 
performance in internal control as it has in the past. 
For example, the Officer Appraisal Work Sheet, NAVPERS 
Homm 1611, evaluates numerous elements of internal 
Goncrol. Internal control should be regarded as a normal 
part of the management process for military personnel. 

b. Civilian Personnel. Civilian personnel have 
structured performance appraisal system. Supervisors 
responsible for overseeing objective setting and 
performance appraisals should ensure that the internal 
control aspects of the functions being performed are 
emphasized. 


2. Quality Control. To ensure that the objectives of 
this program are achieved, quality control shall be 
exercised at all levels of command. Quality control will 
include: 

a. Ensuring appropriate internal control training is 
provided. 

b. Performing adequate Vulnerability Assessments and 
Management Control Reviews. 

c. Preparing accurate and timely reports. 

dad. Establishing a formal follow-up system for 
monitoring corrective actions to material and/or systemic 
deficiencies. 

e. Establishing a system of testing corrective 
actions to material or systemic deficiencies. No 
deficiencies can be dropped from a follow-up system until 
it has been tested (on-site review of the deficiency to 
determine if the stated corrective actions solved the 
deficiency). 

f. Conducting periodic on-site reviews of Management 
Control Review procedures at subordinate commands’ to 
ensure compliance with requirements set forth in this 
instruction. 


3. Vulnerability Assessments and Management Control 
Reviews. Vulnerability Assessments and Management Control 
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Reviews shall be conducted of assessable units covering 
all programs and functions of the activity. An inventory 
of assessable units shall be developed and maintained by 
each activity. Vulnerability Assessments, Management 
Control Reviews and Other Management Actions shall be 
conducted and reported in accordance with this 
INSELrUCE Lome 


4. Responsibilities 
a. Office of Internal Review, COMNAVSEA (SEA OOF3) 
will: 


(1) Establish and maintain the command-wide 
internal control program. 
(2) Provide overall policy, procedures and 


oversight of the command's internal control program. 

(3) Coordinate, prepare and submit all reports 
required for COMNAVSEA's signature. 

(4) Establish a Command training program. 

(5) Maintain COMNAVSEA's tracking system for 
internal control evaluations and corrective actions. 

(6) Establish and coordinate a quality assurance 
program. 

b. NAVSEA field activities, detachments’) and 
headquarters deputy commanders will: 

(1) Designate an internal control coordinator to 
administer the program. 

(2) Ensure internal control systems under their 
purview (including classified systems) are implemented and 
FUNCT LOOMING: 

(3) Ensure that managers (both military and 
Civilian) responsible for internal controls are identified 
and their fitness reports and performance appraisals 
reflect that responsibility. 

(4) Perform vulnerability assessments, management 
control reviews and other appropriate management actions 
and report the results. 

(5) Maintain documentation on all vulnerability 
assessments, management control reviews, other management 
actions and corrective actions. 

(6) Establish quality control to ensure that 
adequate internal controls are established to prevent loss 
or unauthorized use of resources, errors in reports and 
information, illegal or unethical acts, inefficiencies and 
adverse public opinion. 

c. Internal review offices will: 

(1) Evaluate respective command compliance with 
the requirements of this instruction. 

(2) Perform selected audits and test checks of 
internal control documentation and systems. 

(3) Provide technical assistance to managers in 
conducting reviews and assessments. (Internal review will 
not conduct vulnerability assessments and management 
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control reviews except in their own areas of 
responsibility.) 
ad. The NAVSEA Inspector General (SEA OON) will: 
(1) Include the implementation of the program as 
a specific review item during Command Inspections. [Ref. 
Beep. 2-5 | 


C. VULNERABILITY ASSESSMENTS 

The second facet of this discussion focuses on the first 
of two critical processes essential to all internal control 
programs utilized within the Navy--vulnerability assessment. 


A vulnerability assessment is a management evaluation of a 
program or function aimed at identifying the potential for 
mismanagement, loss, fraud, or waste in that program or 
function. The objective of these assessments is to attain 
a ranking of all programs and functions within an 
organization in terms of their susceptibility to loss or 
unauthorized use of resources, errors in reports or 
information, illegal or unethical acts and/or adverse or 
unfavorable public opinion. This ranking process enables 
Management to determine priorities for conducting 
management control reviews. 


The vulnerability assessment process consists of: (1) 
deciding which major programs/functions are applicable to 
the component; (2) determining what aspects of each major 
program/function are performed by the component; (3) 
identifying responsible managers to perform the 
assessments; (4) documenting the vulnerability factors; 
(5) establishing ratings and rankings based on experience 
and judgement; and (6) submitting a brief written report. 
feere Ssencl. Ipyp. 2] 3 
The vulnerability assessment process was first required by 
OMB Circular A-123 [Ref. 23]. Since that process was 
designed to help managers logically assess the risk 
potential within their organizations, it became an essential 
part of all the internal control programs started within the 
Navy [Ref. 3]. As stated earlier, the CNO in his 1986 


instruction established a detailed inventory of assessable 
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units and required that those units be assessed at a maximum 
interval of every two years [Ref. 21]. In August of 1986, 
when OMB revised its Circular A-123 in order to reduce the 
internal control program paper workload, the CNO issued 
interim guidance to reflect a change from the maximum two- 
year requirement for performing vulnerability assessments to 
a five-year requirement [Ref. 24]. Besides attempting to 
reduce the paper workload, the vulnerability assessment 
cycle was changed to provide management more time and 


resources to conduct management control reviews [Ref. 24]. 


D. MANAGEMENT CONTROL REVIEWS 

Management control reviews represent the second and most 
critical process for having a good internal control program. 
It should be considered the most critical process because it 
is during this process that internal controls are corrected 
or added to an event cycle to prevent fraud, waste or abuse. 


Management control reviews (also referred to as internal 
control reviews) are detailed examinations of a 
program/function to ensure internal controls exist, are 
documented and are functioning as intended. These reviews 
should identify weak, nonexistent or excessive controls 
and initiate actions necessary to correct noted 
deficiencies. Management control reviews are performed at 
each DON command and activity by the managers responsible 
for the system of internal controls under review. 


The following steps provide a basic approach to performing 
internal control reviews. 

a. Identify "event cycles." These cycles are the 
processes or series of events leading to accomplishment of 
a function. 

b. Analyze the general control environment; l.e., 
Management attitude, organization structure, personnel, 
delegation and communication of authority (age 
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responsibilities, budgeting and reporting practices and 
organizational checks and balances. 

c. Document event cycles. Documentation should be in 
the form of flow charts or narrative explanations in 
sufficient detail to permit an in-depth analysis of the 
existence and adequacy of internal controls. At a 
minimum, this documentation should identify procedures 
used, personnel performing the procedures and forms or 


other records used in executing the transactions. Also 
internal control points in the event cycle should be 
highlighted. 


dad. Identify needed controls for each transaction 
cycle and compare them to existing controls to determine 
nonexistent or unnecessary controls. 

e. Test established controls to ensure they are 
functioning as intended. 


f. Report the results of the reviews. Identify 
weaknesses and deficiencies in the internal control system 
and recommend necessary corrective actions. (Ref. 3:encl 
i p- 5] 

E. THE INTERNAL CONTROL PROGRAM PROCESS 
The internal control program process is’ similar 
throughout all levels of command within the Navy. It is a 


sequential process that works on a cyclical basis for 


conducting the following seven steps: 


(1) Organizing the process, 

(2) Segmenting the activity, 

(3) Conducting the vulnerability assessments, 
(4) Developing plans for subsequent actions, 
(5) Conducting management control reviews, 


(6) Reporting the results of the internal control 
process, 


(7) Following up on corrective actions. ee 2 = 
5]. 


Of the steps listed above, step one emphasizes the 


assignment of overall coordination and reporting 


43 


responsibilities throughout a local activity's Chane: 
command. It is during this step that overall management of 
the internal control program is assigned to one individual. 
After a focal point is identified, that individual begins by 
planning the remaining six steps with the activity commander 
and the department heads. Step two of the internal control 
process involves the person assigned overall management 
responsi-bility and the department heads coming together to 
identify how to segment the activity. The segmentation is 
Gone to recognize which event cycles should be included on 
the activity's list of assessable units. As described in 
Chapter II, assessable units are also known as event cycles. 
Next, department heads draw up the boundaries identifying 
where a line manager's responsibility for conducting 
vulnerability assessments and management control reviews 
begin and end. Steps three and five were explained in depth 
earlier in this chapter and step six was covered during the 
explanation of FMFIA in Chapter III. [Ref. 21] 

Steps four and seven are quite important and deserve 
further explanation. Developing plans for subsequent 
actions iS important because it focuses management's 
attention on the actions necessary to correct the potential 
risks identified during vulnerability assessments. This 
planning and scheduling allows management to coordinate the 
function from a central location within its activity. After 


the program was initially set up within DON, this step 
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became the initial action for continuing the process on a 
cyclical basis. Steps one and two were eliminated from the 
process unless the activity was reorganized on a significant 
scale. Finally, step seven indicates that follow-up is an 
essential element in the overall process. This step is the 
internal control inherent within the internal control 
program process to ensure that the efforts of the program 
are not lost by management's indifference. [Ref. 22] 

While the process is similar throughout the Navy, the 
schedule for taking action on the process is driven by 
FMFIA's reporting requirements. Each command level within 
the Navy modifies its reporting requirements to allow 
sufficient time for SECDEF to compile his composite report 
to the Congress. Since the field work for this thesis deals 
with a Naval Shipyard, NAVSEA's reporting requirements and 
time frames are listed below as a typical example: 


(1) Results of Management Control Reviews and Reviews of 
Other Management Actions (Annually), 


(2) Internal Control Certification Statement (Annually), 


(3) Consolidated Vulnerability Assessment Form (Every 
Fifth Year), 


(4) Updated Inventory of Assessable Units (Every Fifth 
Year), 


(5) Status of Corrective Actions (Semiannually). (Ref. 
22 ene 3, p. "6 ) 


NAVSEA last updated the above schedule in July of 1987 after 
the CNO issued interim guidance on additional reporting 


requirements [{Ref. 24]. 
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re INTERNAL CONTROL PROGRAM EVALUATION 

Before turning in the next chapter to the results of an 
on-site study of one Naval Shipyard, a summary of the Naval 
Audit Service's latest evaluation is provided as an overview 
for comparing the observations made at a local activity. 

The Naval Audit Service (NAVAUDSVC) is the internal 
review function for SECNAV. Since passage of FMFIA, 
NAVAUDSVC has been tasked with periodically reviewing the 
Navy's implementation of the internal control program. To 
date, NAVAUDSVC has issued three composite advisory reports, 
the last report being issued on 24 August 1987 [{Ref. 25}. 
That last report covers Navy-wide implementation progress 
made through fiscal year 1986. Although that information is 
dated by 18 months, Report 130046, Implementation of the 
Department of the Navy's Internal Control Program is the 
latest opinion published by the NAVAUDSVC [{Ref. 25]. 

Report T30046 had as its basic objectives to evaluate 
the accuracy of the procedures used to identify and report 
on material weaknesses, to determine if local commands had 
adequate follow-up systems in place, to determine the status 
of corrective actions from previous years, and to assess the 
accuracy of the SECNAV's Internal Control Statement to 
Congress [{Ref. 25}. The report did not evaluate how the 
Navy's Internal Control Program promoted conformity to GAO 
standards and the general objectives of FMFIA. NAVAUDSVC 


limited this latest audit to reviewing results of the 
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implementing process [Ref. 25]. During that review, 28 
major commands, including NAVSEA, were evaluated. Results 
of NAVAUDSVC's audit were classified into two parts. Part 
one covered findings from the previous audit, Report T30005 
(Ref. 26] and part two covered the objectives of the latest 
audit, Report 1T30046 [Ref. 25]. The major finding in part 
one was that some of the 28 commands audited had not 
established effective follow-up systems for monitoring 
corrective actions. This failure was a repeat finding from 
the first audit in 1984, Report T30254 [Ref. 27]. Findings 
classified under part two were as follows: subordinate 
commands did not consider all sources for identifying 
material weakness, such as old audit reports or inspection 
findings; the required certification statements on the 
adequacy of internal controls forwarded up the chain of 
command as feeder statements by local activities were 
incomplete; follow-up systems were still ineffective or not 
established; and the CNO was submitting command inspections 
for operating forces instead of management control reviews. 
Findings in parts one and two represent the major concerns 
noted by the NAVAUDSVC on a Navy-wide basis. NAVSEA, while 
included in those reports, was found to have an adequate 
follow-up system and did not have any of the other major 


deficiencies noted above. [Ref. 17:p. 43] 
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V. AN INTERNAL CONTROL PROGRAM WITHIN 
ONE NAVAL SHIPYARD 


A. AN INTRODUCTION TO A SHIPYARD'S INTERNAL CONTROL 

PROGRAM 

This chapter describes an internal control program as 
developed by a single Naval Shipyard. The time frame to be 
described represents a period of six years from September 
1982 through March 1988. Only one shipyard was studied and 
may not be representative of all Naval Shipyards; however, 
based on comparative accounting figures, the shipyard 
selected for study is one of the top four in total revenues 
and one of the top three in total labor hours utilized. All 
accounting figures cited in this chapter and the next were 
extracted from NAVSEA's Navy Industrial Fund Reports System 
(NIFRS) report dated 2 February 1988. Descriptions 
contained in this chapter are a combination of on-site 
review of historical records, personal observations of the 
shipyard organization and information obtained from 
interviews with shipyard, NAVSEA and NAVAUDSVC personnel. 
This chapter emphasizes the evolution, organizational 
structure and internal control process used by the shipyard. 
Individual internal control case studies are analyzed in 


Chapter VI. 
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B. AN EVOLUTION OF ONE SHIPYARD'S INTERNAL CONTROL 
PROGRAM 


As discussed in Chapter IV, the Navy did not officially 
start its development of an internal control program until 
SECNAV issued the first Navy guidance in July 1983. The 
Naval Shipyard that was studied had no records concerning a 
formal internal control program prior to that time as 
confirmed by the Director of Internal Review. While no 
formal internal control program existed prior to 1983, all 
of the nine shipyard employees interviewed acknowledged that 
internal controls were part of their existing accounting and 
nonfinancial systems. Personnel who were employed at the 
shipyard prior to FMFIA's passage attributed the responsi- 
bility for monitoring the use of internal controls 
exclusively to the internal review staff. The common belief 
of all the line managers interviewed was that breakdowns in 
internal controls were noted only when discovered by audits 
or inspections or when circumstances in an operation 
required management's attention. Phig@meto souly 1983, 
according to the Director of Internal Review, internal 
controls were only considered as a management tool in 
response to problems. There was no formal mechanism or 
requirement that caused line managers to anticipate the 
possibility of fraud, waste or abuse. The Director of 
Internal Review said the anticipation of potential problems 
was a strategic planning function done mostly by top level 


management during budget formulation and execution. 
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Through interviews with the Director of Internal Review 
and the Internal Control Program Coordinator, along )vaea 
examination of historical records, it was determined that 
the shipyard commander, in response to the July 1983 SECNAV 
guidance, did at least three things to implement an internal 
control program. First, he assigned responsibility for the 


internal control program to personnel in the Management 


Engineering Division. Duties were to be performed on a 
collateral duty basis. There were no other shipyard full 
time personnel or assets assigned to this function. The 


second accomplishment by the shipyard commander was to 
present a numerical summary of the corrective actions taken 
in response to weaknesses identified by vulnerability 
assessments and to provide a letter describing program 
implementation as an input to SECNAV's certification and 
report to Congress in December of 1983. Verification of the 
1983 input was possible only through a verbal confirmation 
from personnel performing those duties because no records 
from that period could be located. The third and final 
action taken in 1983 by the shipyard commander was to 


require department heads to have their line managers support 


the program's identified objectives. In 1984, there were 
two advancements in the internal control program. As 
described by the Director of Internal Review, the 


Management Engineering Branch Director had obtained enough 


cooperation from line managers to complete the first 
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Management control reviews based on the 1983 vulnerability 
assessments and to report semiannually on schedule as 
required. Confirmation for those actions was once again 
obtained only verbally because local files contained no 
documentation covering the internal control program for any 
part of 1984. 

As noted in the last chapter, GAO and the NAVAUDSVC had 
reviewed DOD's Internal Control Program after the first year 
following FMFIA's passage. Those reports noted a lack of 
training and documentation concerning DOD's implementation 
of the internal control program. A lack of any records on 
the actions taken by the shipyard parallels those findings. 

During 1985, the execution of the internal control 
program remained under the guidance of the Management 
Engineering Branch. The Director of Internal Review 
recalled that an audit of the internal control program 
during 1985 revealed that the program operated in the same 
manner as it had during 1984. He stated that from his 
perspective neither the quantity nor quality of actions 
concerning the internal control program had changed from the 
previous year's effort. However, there was one action taken 
in 1985 by the shipyard commander concerning the Director of 
Internal Review and his interface with the internal control 
program. The Internal Review function was separated from 
the Comptroller's Department. It was after this action that 


the Director of Internal Review said his staff's actions 
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concerning the audit of the internal control program became 
more formal and extensive. The Director of Internal 
Review's records concerning the shipyard's implementation 
and execution begin with the shipyard commander's December 
1985 report to NAVSEA. This report was the same semiannual 
report that was to be forwarded up the chain of command so 
that the SECDEF could report to Congress which event cycles 
required internal controls and what actions the shipyard 
took to implement needed internal controls. Also, this 
report contained the shipyard commander's annual certifica- 
tion statement to the CNO for inclusion in the SECDEF's 
report to Congress on the adequacy of internal controls 
within the DOD. 

As discussed in Chapter IV, GAO and NAVAUDSVC completed 
their reviews of DOD's implementation efforts in late 1984. 
According to the NAVSEA Internal Control Coordinator, NAVSEA 
in 1985 organized and began to execute quality assurance 
checks on its shipyards' internal control programs in 
response to the GAO and NAVAUDSVC reviews. The NAVSEA 
Internal Control Coordinator also stated that NAVSEA's 
quality assurance efforts began to affect the shipyard under 
study in January of 1986. Continuing the historical 
Gescription, the NAVSEA Internal Control Coordinator stated 
she visited the shipyard and made three recommendations to 
improve the program's performance. The first recommendation 


was that the shipyard should start retaining documentation 
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on actions taken concerning the internal control program. 
To aid the shipyard in this task, NAVSEA's Internal Control 
Coordinator delivered the SECDEF 1984 Internal Control 
Course and conducted on-site training for the internal 
review staff and the Management Engineering Branch 
personnel. The last two recommendations were that the 
Internal Review Director be given responsibility for the 
internal control program and that one person be asSigned as 
a full time coordinator for the program. 

The Director of Internal Review confirmed that the 
shipyard commander followed all of those recommendations 
within one month's time. Shortly after this change in local 
policy, the following actions were taken: 


(1) The shipyard performed detailed vulnerability 
assessments on 238 assessable units, 


(2) The shipyard assigned 17 collateral-duty Departmental 
Internal Control Coordinators, 


(3) The shipyard drafted a shipyard instruction on the 
internal control program, 


(4) The shipyard conducted six complex management control 
reviews, 


(5) The shipyard conducted detailed training on the 
Internal Control Course. 


(6) The shipyard implemented 15 new internal controls. 
According to the Director of Internal Review, the actions 
taken in 1986 should be considered the first actions to 
approach the requirements of FMFIA, because it was during 
1986 that the shipyard completely employed all seven steps 


involved in the internal control process. In his words, 
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Without the proper documentation and the line manager's 
involvement in the internal control program, it is 
impossible in good faith to state that internal controls 
are adequate. 

The Director of Internal Review stated that the 
improvement and expansion of the internal control program 
continued in 1987 with nine additional management control 
reviews being completed. The researcher's review of the 
internal control program records confirmed that all reports 
required by NAVSEA Instruction 5200.13 had been retained and 
forwarded to NAVSEA. The researcher examined all retained 
records concerning actions taken since January 1986 and 
confirmed the Director of Internal Review's statement that 
there were now adequate records for audit and review by 
concerned parties external to the shipyard. The NAVAUDSVC 
auditor also confirmed that the shipyard was retaining 
better documentation after the 1986 reorganization. During 
the records review, the researcher noted that 1987 was the 
first year to have an annual internal control program 
schedule on file. Further discussions with line managers 
revealed that the Internal Control Coordinator followed the 
schedule as part of the normal routine for the internal 
control program. 

The research for this thesis concluded in March of 1988. 
Through that period the researcher was able to determine 
through interviews that all previous actions that were 
cyclical with regard to the internal control program were 


continuing. Also, the researcher found out from interviews 
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that the new improvements planned for the remainder of 1988 
concerned a new schedule for vulnerability assessments, 
issuance of a drafted internal control program instruction 
and simplification of the supporting paperwork required by 


the Navy's Internal Control Program. 


C. THE SHIPYARD'S INTERNAL CONTROL PROGRAM ORGANIZATION 

As discussed earlier, local commanders are required to 
implement an effective system for monitoring and ensuring 
that good internal controls are used within their 
organizations. The shipyard commander has the overall 
responsibility for his internal control program. To support 
him, there are organizations internal and external to the 
shipyard that assist in the execution of the requirements of 
FMFIA. Internally, according to the local shipyard draft 
instruction and NAVSEA Instruction 5200.13, he is supported 
by the Internal Review Department, the Internal Control 
Program Coordinator, the Director of Industrial Relations, 
department heads and line managers [Ref. 22]. Externally, 
he is assisted by NAVAUDSVC's local shipyard on-site 
auditors [Ref. 3]. 

The principal working relationship necessary for the 
internal control program to function effectively is the 
interface between the shipyard commander and the Director of 
Internal Review [Ref. 22]. According to the Director of 
Internal Review, that interface is both frequent and 


mutually supportive. When the shipyard commander assigned 
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the Director of Internal Review the responsibility for 
program execution, he gave the Director a full time civil 
servant, an increased budget and the authority to develop 
policy for the shipyard's overall program execution. When 
asked by the researcher, the Director of Internal Review 
emphasized that the lines of communication between the 
shipyard commander and himself were both open and direct. 

The next participant in the program is the Director of 
Industrial Relations. He is designated to assist managers 
and supervisors in developing Internal Control elements 
Within employee performance appraisals. That action, as 
stated by the Director of Internal Review, is intended to 
provide the incentive for all civilian employees to 
cooperate with the requirements of the program. 

During the researcher's interview with the Internal 
Control Program Coordinator, the facts that the Internal 
Control Program Coordinator was hired in 1986 and is a 
Management Analyst, GS-12, indicated when and what 
Capabilities the shipyard commander agreed were required to 
manage the internal control program. As obtained from the 
shipyard's organizational chart, the Internal Control 
Program Coordinator was assigned to the Director of Internal 
Review. The Director of Internal Review stated that the 
Internal Control Program Coordinator is provided support 
from the Internal Review Staff for the purposes of 


scheduling, auditing and report compilation. According to 
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the Internal Control Program Coordinator's position 
description, he is assigned the primary responsibility for 
coordinating the internal control process. Although 
responsible for coordination, the Internal Control Program 
Coordinator does not interface directly with department 
heads. Coordination for the program at that organizational 
level is between department heads and the Director of 
Internal Review. In the draft internal control program 
instruction and as described by the Director of Internal 
Review, department heads are required by the shipyard 
commander to appoint departmental representatives to assist 
the Internal Control Program Coordinator and to ensure that 
the department heads take an active interest in the internal 
control process. As part of that process, department heads 
encourage and evaluate their line managers' cooperation with 
both the Departmental Internal Control Coordinator and the 
Internal Control Program Coordinator [Ref. 22]. 

At the line manager's level of authority, internal 
controls are evaluated, developed, improved and sometimes 
eliminated so as to prevent fraud, waste and abuse. It is 
the line managers who should provide the primary efforts 
necessary to ensure the program's success or failure. fRef. 
ap. 7] 

All the relationships described above are internal to 
the shipyard's organization. An organization external to 


the shipyard is the NAVAUDSVC. The NAVAUDSVC has auditors 
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permanently stationed at all eight Naval Shipyards, and 
perform audits on a continuing basis. As part of their 
responsibilities, auditors evaluate the effectiveness of 
internal controls. As those evaluations take place, the 
auditor provides recommendations to shipyard personnel on 
how systems or operations can be improved. Recommendations 
from the auditors assist the local line manager in 
developing the correct control to fix actual or potential 
problems. According to the NAVAUDSVC auditor interviewed, 
the Auditor General of the Navy has a policy that the Navy's 
Internal Control Program is to be an integral part of their 
daily work. 

In summary, the shipyard's organization executes its 
program by delegating authority down to the Director of 
Internal Review who acts both laterally and vertically to 
execute the program. The Director of Internal Review's 
principal focal point for implementation is the Internal 
Control Program Coordinator. The Internal Control Program 
Coordinator then accesses line managers through departmental 
internal control program coordinators. The burden for 
taking corrective action rests primarily with the line 
managers who are expected to coordinate their actions with 
the overall internal control program [Ref. 22:encl. 3, p. 
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D. HOW THE SHIPYARD USES THE INTERNAL CONTROL PROCESS 

In Chapter IV, a seven step process was identified as 
the basic structure around which shipyards should form their 
internal control program. The shipyard in this study was 
found by the researcher to be utilizing that basic process. 
In this section, the shipyard's execution of that process is 
expanded upon to show how that process was tailored to fit 
the needs and desires of the shipyard commander. The 
discussion that follows in this section was developed by the 
researcher from interviews with the Director of Internal 
Review and the Internal Control Program Coordinator. 

The first step in the internal control process was the 
organizing stage. In most cases this step should have been 
a one-time evolution if the internal control program was 
meeting the basic requirements identified in NAVSEA 
Instruction 5200.13 for an effective internal control 
program. But, the shipyard was required to undertake that 
step twice, once in 1983 when the program started and once 
again in 1986 after NAVSEA suggested that the internal 
control program be improved. The reorganization of the 
internal control program moved the program's responsibili- 
ties from the Management Engineering Branch to the Director 
of Internal Review. Also, reorganization provided the first 
opportunity to conduct necessary training through the use of 


the Navy's Internal Control Course. After conducting the 
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training, the shipyard was able to start maintaining records 
in accordance with NAVSEA Instruction 5200.13. 

The next step in the internal control process was the 
segmentation of the shipyard into assessable units. That 
step was accomplished on at least three separate occasions, 
according to the Director of Internal Review, first in 1984, 
again in 1986 and finally again in 1987. Normally, the 
segmentation of the activity should be required only once. 
But in this case it occurred three times because, with each 
successive attempt the segmentation became more detailed. 
These facts were verified by the researcher's examination of 
the records retained after 1986. Those records contain 
correspondence between the shipyard commander and NAVSEA 
that explained the three attempts the shipyard made at 
updating its assessable units inventory. The Director of 
Internal Review explained to the researcher that he had 
found, that through greater segmentation of the assessable 
units, more line managers became involved in the program. 
Greater segmentation meant that, instead of line managers 
looking at a large event cycle, such as the supply function 
for the shipyard, they were required to break it down into 
smaller event cylces. Examples of smaller supply functions 
are event cycles like the material recieving process, the 
imprest fund process, the open purchase process. It was the 
Director of Internal Review's contention that as segmenta- 


tion increased, greater numbers of line managers became 
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involved in the management control review process. With 
more line managers involved, event cycles could be more 
closely assessed for weaknesses and then those event cycles 
could be more easily corrected. 

Step three, the vulnerability assessment step, had 
occurred twice since the program's inception. In 1984, only 
broad areas were assessed and only a handful of event cycles 
were found to have material weaknesses, according to the 
Director of Internal Review. After the 1986 reassessment, 
greater potential errors were discovered, as documented in 
the shipyard's semiannual report to NAVSEA. This increase 
in potential errors was not due to any specific decline in 
shipyard's performance but, according to the Director of 
Internal Review, the increase was caused by the improved 
efforts in assessing the segmented areas. After the 1986 
vulnerability assessments and early in 1987, the shipyard 
commander issued a local notice advising line managers that 
in addition to the those assessments, potential future 
management control reviews would also be scheduled based on 
four additional inputs to the annual internal control 
program schedule. These additional inputs, according the 
shipyard commander's notice, were shipyard commander 
requests, findings from internal reviews, findings from 
NAVAUDSVC audit reports and CNO interest items. 

The fourth step in the internal control process was 


developing plans for subsequent actions. According to the 
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Internal Control Program Coordinator, the shipyard performed 
this step on a semiannual basis starting in January of 1987. 
Prior to each semiannual report to NAVSEA, the Internal 
Control Program Coordinator said he updated the shipyard 
commander's annual internal control program schedule. He 
considered the following questions about the local program: 


(1) How many vulnerability assessments require a 
management control review? 


(2) How many audit findings need a management control 
review? 


(3) How many new CNO interest items need a management 
control review? 


(4) What previous actions identified by a management 
control review need to be completed? 


(5) When should training for departmental coordinators be 
conducted? 


(6) When should line managers conduct management control 
reviews? 


(7) When should the Internal Review Staff conduct audits 
of management control reviews? 


During this scheduling and planning process, the Internal 
Control Program Coordinator explained, he also conducted his 
follow-up of the internal control program. The researcher 
checked on this planning and follow-up process by inquiry of 
the Director of Internal Review and the six line managers 
interviewed during the field work conducted in March of 
1988. 

Step five of the internal control process was the 
execution of management control reviews. At the shipyard, 


this step was performed on a continuing basis and was not an 
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Svolucion Limited to a particular point in time. The reason 
for extending the process was because complexity of 
evaluating, designing and implementing new internal controls 
required managers to spread the workload over time to fit 
their schedules, according to the Internal Control Program 
Coordinator. He would interface with line managers daily in 
some cases to help with the management control reviews. The 
line managers interviewed by the researcher confirmed that 
practice. 

Step six in the internal control process concerned the 
reports and annual certification forwarded to NAVSEA. The 
files on hand after 1986 were complete and detailed when 
compared by the researcher to the standards outlined in 
NAVSEA Instruction 5200.13 [Ref. 22]. 

Step seven is the follow-up on corrective actions. The 
Internal Control Program Coordinator said he used the 
semiannual reports as his basis for conducting follow-ups 
and asking the Internal Review Staff to review management 
control reviews completed during the preceding six month 
period. As already mentioned, follow-up occurred prior to 
each semiannual report and involved the Coordinator, 
Internal Review Staff, line managers and, in some cases, 
both the Director of Internal Review and department heads. 
While the Director of Internal Review and the Coordinator 
insisted that follow-up actions were thorough, there was at 


least one case found during the field work where follow-up 


Ce 


was not aggressive enough to prevent the automated data 
processing functions from falling behind in tale 


corrective actions by at least one year. 
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VI. AN EVALUATION OF THE SHIPYARD'S 
INTERNAL CONTROL PROGRAM 

A. OVERVIEW 

The primary purpose of this study is to examine the 
implementation and execution of the Navy's Internal Control 
Program at the local activity level. Chapter V described 
the implementation and some of the unique circumstances that 
caused the shipyard to develop its internal control program. 
This chapter describes and evaluates the execution of the 
internal control program. A combination of three approaches 
was used to examine the execution of the shipyard's program. 

Approach number one was designed to obtain impressions 
from four key participants who had either oversight or 
Management responsibilities. To obtain this general 
impression, two of the persons interviewed were external to 
the shipyard's organization and two of the persons 
interviewed were internal to the shipyard's organization. 
The two external persons interviewed were the on-site Naval 
Audit Service Auditor and the NAVSEA Internal Control 
Coordinator. The two internal persons were the Director Gite 
Internal Review and the shipyard Internal Control Program 
Coordinator. 

Approach number two for evaluating the internal control 
program's execution was to compare the requirements 


mandated by NAVSEA against the actions taken by the shipyard 
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for program implementation. The third and final approach 
was to describe six case studies of specific examples where 
internal controls were added to prevent potential errors or 
correct actual problems. The descriptions’ contain 
evaluations of the use of the internal control process and 
point out where the controls succeeded or failed. 

All of the results identified within this chapter were 
obtained through an on-site examination of operations or 
records and by conducting person-to-person interviews. 
Facts and figures were obtained from the NIFRS report, a 
monthly summary of all eight Naval Shipyard's financial and 
management accounting reports, and from the shipyard's 
historical records retained since 1982. 

B- FOUR PERSPECTIVES ON HOW THE SHIPYARD EXECUTES (Tne 

INTERNAL CONTROL PROGRAM 

1. NAVSEA's Internal Control Coordinator Comments 

The NAVSEA Internal Control Coordinator's comments 
apply to all the Naval Shipyards and do not reflect only the 
circumstances existing within the one shipyard studied. 
NAVSEA'sS program coordinator said that the shipyards' 
internal control programs are supportive of the overall 
goals set by NAVSEA. However, the implementation of the 
program has been slower than NAVSEA initially expected. 
According to the NAVSEA Internal Control Coordinator, the 
most beneficial accomplishment of the internal control 


program is that it lessens the burden on the shipyard 
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internal review staffs for detecting potential errors in all 
shipyard functions. The program has put that responsibility 
on the line managers and has increased both the coverage and 
the frequency of management control reviews. While NAVSEA's 
Coordinator said that the program is beneficial, she notes 
that the program is at times far too paperwork intensive. 
Because of the complexity of maintaining records and 
documenting actions taken, there is a reluctance by the 
shipyard personnel to use the internal control process 
extensively. 

One of the more important aspects of a shipyard's 
internal control program is the freedom to investigate 
potential problems by local management and plan _ the 
necessary corrective actions. The NAVSEA Internal Control 
Coordinator said that in some instances, when shipyard 
commanders had identified potential or actual problems in 
their semiannual reports, those reports became a basis for 
criticizing shipyard operations. The identification of 
problems in too great a detail had invited micro-management 
from above the shipyard commander's level of authority. The 
NAVSEA Internal Control Coordinator said that, although that 
practice had only happened in one or two isolated cases 
during the early years of the Program's implementation, the 
impact of that practice caused greater care to be taken by 
shipyard commanders as to how and what problems were 


identified to higher authorities. 
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The NAVSEA Internal Control Program Coordinator 
explained that the shipyard commanders increased concern 
over the reporting requirement had two specific beneficial 
results. First, it eliminated the attempt by shipyard 
commanders to identify small or insignificant details that 
Should have been handled locally. Second, it encouraged 
shipyard commanders to scrutinize more closely the content 
of the actions being submitted by line managers for the 
semiannual reports. 

2. NAVAUDSVC Auditor Comments 

The second external impression of the shipyard's 
execution of internal controls was obtained from an 
interview with the shipyard's on-site NAVAUDSVC Auditor. 
This auditor had an in-depth knowledge of this shipyard 
because he had been assigned to it since the passage of 
FMFIA. His tenure at that shipyard gave him the ability to 
evaluate the program's implementation over its’ entire 
history. 

From the auditors's perspective, the program has 
several benefits and at least two major weaknesses. The 
benefits are these: 


(1) Shipyard personnel and line managers support the 
internal control program. 


(2) Internal controls are more widely used to prevent 
potential errors. 


(3) The shipyard's internal review staff and the 
NAVAUDSVC auditor more frequently coordinated their 
efforts concerning the evaluation of “antermi® 
Controls an auditse 
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(4) The most significant benefit is that the Internal 
Control Program causes shipyard managers to become 
more aware of their functions and how they operate 
with regard to potential or real material weaknesses. 

While the NAVAUDSVC auditor sees several benefits, he 
believes that the program is not as successful as it should 
be at combating fraud, waste and abuse. There are currently 
two significant problems. The first is that local managers 
focus too much of their management control review effort on 
reviews specifically mandated by the CNO. The second is 
that the follow-up efforts on newly implemented controls are 
insufficient in most cases to make long lasting changes. 
The NAVAUDSVC auditor believes that, if the follow-up aspect 
were emphasized, more the program could be a more effective 
management tool. 

Having presented these two external views on the 
shipyard's internal control program, two internal 
perspectives are also provided to balance the overall 
impression about how the program was executed. 

3. Director of Internal Review Comments 

The first internal perspective was obtained from the 
Director of Internal Review. His general comments indicate 
that the program's biggest problems are twofold. The first 
problem is that the process requires too much paperwork, 
which tends to inhibit responsiveness from the line 
managers. Secondly, the shipyard is highly decentralized 


and production-oriented. Both circumstances work against 


the idea of a centrally managed internal control process. 


62 


Because of the decentralized nature of the shipyard's 
organization, attempts at improving event cycles that cross 
lines of authority are far too difficult and time consuming 
for a single line manager. To provide the coordination 
necessary to correct the complex event cycle's problems, one 
or more line managers would need to be taken away from their 
primary production goals. When the internal control program 
runs counter to those production goals, line managers accord 
compliance with the program a lower priority for accomplish- 
ment. Although the Director of Internal Review recognizes 
that situation, he summarizes command support to overcome 
that situation as follows: 
The Office of Internal Review has a very supportive 
relationship with the current shipyard commander. The 
shipyard commander has depended on the Internal Review 
Organization for being the lead in the internal controls 
area and has provided the necessary tools and muscle to 
achieve this goal. As in any relationship, this remains a 
two way street. He has recognized the positive actions 
taken by the participants in this program by giving us and 
them more responsibility. 
The Director of Internal Review stated it was his 
responsibility to monitor the overall efforts "of =e 
internal control program and to maximize its use. He noted 
that the shipyard's internal control program was to be 
conducted by the line managers without providing them 
additional time or personnel assets. The costs of executing 


the Program were absorbed within the shipyard's overhead 


GOSts. 
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A, internaweeentr ol Program Coordinator Comments 


As a final perspective, the views of the Internal 
Control Program Coordinator, who is the manager most closely 
associated with the internal control program, stated that 
since 1986 the shipyard has made significant improvements in 
documentation, training and control. Those accomplishments 
were made possible only through the strong support given by 
the shipyard commander and the Director of Internal Review. 
Line managers are becoming more effective at identifying 
problems and designing controls. However, two areas still 
require further improvements to make the program manageable. 
The first area concerns further attempts to streamline the 
paperwork involved in the process. The second area concerns 
the need for a more effective follow-up procedure. The 
Internal Control Program Coordinator believes that it is 
most difficult to convince managers that the process is only 
effective if it is coupled with a strong’ follow-up 
procedure. 

C. HOW THE SHIPYARD MET THE REQUIREMENTS OF THE NAVY'S 
INTERNAL CONTROL PROGRAM 
Approach number two compares the shipyard's execution of 
the internal control program with the requirements mandated 
by SECNAV, CNO and NAVSEA. As may be recalled from Chapter 
IV.B.3, there are at least six basic requirements) that 
should be followed in executing a good internal control 


Beegram [Ref 22]. The following descriptions provide a 
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comparative review of how the shipyard met those 
commitments. 
1. Requirement Number One 
The shipyard is to designate an Internal Control 
Program Coordinator. The shipyard performed this function 
twice, once in 1983 on a collateral duty basis and again 
during the 1986 reorganization of the program. 
2. Requirement Number Two 
The shipyard is to ensure that an internal control 
system is implemented and functioning. This requirement was 
accomplished by drafting a shipyard internal control program 
instruction and by continuously performing the seven steps 
of the internal control process identified in Chapter IV.E. 
3. Requirement Number Three 
The shipyard is to ensure that both military and 
civilian personnel have their responsibilities regarding 
internal controls documented within their evaluations and 
performance appraisals. According to the December 31, 1985 
report to NAVSEA, the shipyard was achieving this goal for 
only 36 percent of its line managers. The Director en 
Internal Review knew of no further improvement concerning 
this requirement since that 1985 report. Subsequent audits 
of the Program confirmed the Director's belief about the 


shipyard's status with respect to this requirement. 
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4. Reguirement Number Four 


The shipyard 1s to ensure that vulnerability 
assessments, management control reviews and other 
appropriate management actions are performed and reported. 
A review of the historical records revealed that in the 
early years of the program those efforts were minimal. 
Prior to 1986 the shipyard conducted approximately 37 
vulnerability assessments and only 24 management control 
reviews. After 1986, the shipyard conducted approximately 
250 vulnerability assessments and 77 management control 
reviews. 

5. Requirement Number Five 

The shipyard is to maintain documentation on all 
vulnerability assessments, management control reviews, other 
management actions and corrective actions. All the required 
documentation was being maintained after the 1986 
reorganization. The additional management actions included 
correspondence on required reports, annual schedules, 
periodic training, updates on actions taken and historical 
files of vulnerability assessments and management control 
reviews. 

6. Requirement Number Six 

The shipyard is to establish quality control to 
ensure that adequate internal controls are in place to 
prevent loss or unauthorized access to resources, prevent 


errors in reports and information, prevent illegal or 
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unethical acts and to prevent inefficiencies and adverse 
public opinion. Under this requirement, the shipyard's line 
managers believed that the Internal Review Staff and 
Internal Control Program Coordinator were to perform the 
quality contromerunctiren- However, this quality control 
review requirement was designated by NAVSEA to be a 
shipyard-wide requirement and not an internal review 
requirement. The internal review function was given its own 
detailed responsibilities to evaluate overall program 
compliance, to audit internal control documentation and 
systems and to provide technical assistance to managers 
conducting vulnerability assessments and management control 
reviews [Ref. 22]. At the time of this field work, there 
was no internal procedure that required managers to follow- 
up on internal control actions taken. While interviewing 
the Director of Internal Review, it was discovered that 
there were no surprise audits or spot checks performed on an 
unannounced basis to encourage compliance with the newly 
implemented controls. 


D. SIX EXAMPLES OF HOW THE INTERNAL CONTROL PROGCKA 
WAS USED TO MAKE A DIFFERENCE IN SHIPYARD OPERATIONS 


1. Case Study Format 
The third phase of this examination of the execution 
of a shipyard's internal control program uses six case 
studies. All information in these six case studies was 


obtained through on-site observation or examination of 
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records, facilities and personnel preforming the functions 
described. Accounting data cited were obtained from the 
February 1988 NIFRS report and locally prepared operating 
statements. Operating procedures evaluated were matched 
against local instructions governing those procedures. 
Since the exact shipyard selected for examination and 
evaluation is not specifically identified to maintain 
confidentiality, local instructions are not cited by name 
or number. Navy-wide guidance concerning a function 
involved in any of the following case studies is identified. 
All six case studies were conducted in the same manner, 
using a standard format. The format was designed by the 
researcher to provide a consistent approach for drawing 
conclusions later. The basic format for the six studies is 
as follows: 

(1) Background. This section describes the general 
working environment of the function being studied to 
indicate how the function impacts on_- shipyard 
operations. 

fy Event “€ycle. This section describes the systematic 
steps involved in the function in which a weakness 
was identified. 

(3) Finding. This section describes a material weakness 
discovered by the line manager of the event cycle 
being described. 

(4) The Controls Used To Prevent Potential Errors. This 
section describes the controls the shipyard line 
manager implemented to prevent the deficiency noted 
ih waeet inciarnc . 

(5) Compliance Testing. This section describes the 
compliance testing performed by the researcher to 


determine how well the newly implemented internal 
controls were working. 
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(6) Risk Assessment. This section describes how the 
researcher evaluated risk in the event cycle after 
the line manager implemented the new internal 
CONtKOLS. Risk 1s described by using two 
classifications, inherent risk and control risk. 
Inherent risk measures the researcher's expectation 
that material errors may exist in the event cycle 
before considering the effectiveness of internal 
Comtroke. Control risk measures the researcher's 
expectation that material errors in the event cycle 
will not be prevented or detected by the internal 
COMmeLols:, 

(7) Weaknesses With The System In Place. This section 
describes additional weaknesses discovered by the 
researcher after the event cycle was corrected by the 
shipyard's line manager. 

(8) Management's Commitment Rating. This section 
describes how the line manager of the event cycle 
being studied was rated by uSing a standardized 
questionnaire (Appendix) designed by this researcher. 


2. Case A--Blanket Purchase Agreement Function 
a. Background 

The Blanket Purchase Agreement Function iS a 
Supply Department activity performed within the Purchase 
Division, Code 530. There are five blanket purchase 
agreement agents assigned to handle 350 indefinite delivery 
COntracers. The Naval Shipyard uses this type of contract 
for approximately 40 percent of its annual purchase 
requirements. Total expenditures for shipyard purchases is 
approximately $33 million annually, of which $13.2 million 
is expended by using indefinite delivery contracts. Open 
purchase requirements are received from the Naval Shipyard, 
Naval Base and tenant activities to support a primary 


mission of ship repair and overhaul. 
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b. Event Cycle 

The blanket purchase agreement function begins 
with a customer's request for non-standard material or 
supplies. If the non-standard request can be provided by an 
established indefinite delivery contract, the request is 
forwarded to one of five blanket purchase agreement agents 
for processing. The agent is authorized in writing to place 
a verbal order with an approved vendor for the materials 
requested. The blanket purchase agreement agent directs the 
vendor to deliver a specified quantity to the customer. 
Prior to placing an verbal or written order, the agent is 
required to ensure that the original request has_' the 
critical elements necessary to authorize the placement of 
that order. Examples of the required elements are proper 
technical review, appropriate funding, adequate descriptions 


of the requested items, requisition numbers and any other 


key elements required by the Naval Supply Acquisition 


Regulation Supplement [Ref. 28:sec. 16.5, pp. 1-5}. The 


receipt for material and the ultimate payment for that 
material is done separately from the ordering function. 
Therefore, this event cycle ends with the agent's forwarding 
of the order to the Comptroller for payment. The 
Comptroller will pay the vendor upon receipt of a 
"confirmation of material receipt" from the customer 


authorized to receive and accept that material. 


te 


Cy (Pr imednaic 

During a management control review in Fiscal 
Year 1986, the line manager identified the fact, that if 
competent personnel were not functioning as blanket purchase 
agreement agents, the authorization function fulfilled by 
this cycle would be in jeopardy of failure. Additionally, 
it was noted that agents were not appointed in writing. 
This control was designed by the Director of the Purchasing 
Division to limit the persons authorized to place verbal 
orders against indefinite delivery contracts. Without this 
control, the chance of an unauthorized purchase was greatly 
increased. 

ad. The Controls Used to Prevent Potential Errors 

There were two controls identified by the 
Director of the Purchasing Division to ensure that the 
mandatory policies for contracting described in the Naval 
Supply Acquisition Regulation Supplement [Ref. 28:sec. 16.5, 
pp. 1-5] were met. The two requirements were that all 
persons placing verbal orders against blanket purchase 
agreements be appointed in writing and that all purchasing 
agents will attend formal Navy training for contracting. 

Control number one was an administrative control 
to have one blanket purchase agreement agent attendee. 
Naval Supply System's approved Small Purchase Course and to 
have four blanket purchase agreement agents attend the Small 


Purchase Refresher Course. 
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Control number two was to authorize all blanket 

purchase agreement agents in writing to place verbal orders. 
e. Compliance Testing 

Since the target date for implementing the 
training control was dependent upon the availability of 
training quotas, the Director of the Purchasing Division was 
waiting for the quotas to become available in July 1988. 
This delay prevented the researcher from performing 
compliance tests of the first control during the March 1988 
field work. Although compliance testing for the first 
control was impossible, an investigation into the interim 
actions taken by the line manager was considered an 
appropriate alternative to evaluate the program's impact. A 
review of the system in place revealed that all blanket 
purchase agreement agents had aNcine than one year's 
contracting experience and they all had been given local 
training on the applicable regulations. Additionally, all 
agents were routinely supervised by an appointed Contracting 
@eticer. Compliance testing of the second control was 
accomplished by asking the line manager if the agents had 
been authorized in writing to place verbal orders. 

f. Risk Assessment 

The inherent risk for this event cycle is high 
because the complexity of purchasing materials from the open 
market is great. The requirements to authorize the 


placement of an order is a very detailed process outlined in 
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the Naval Supply Acquisition Regulation Supplement [Ref. 28: 


sec. 16.5, pp. 3-5]. This process is further complicated by 
the wide variety of materials requested in these non- 
Standard purchase requests. The dollar value for these 
materials can range from small amounts to hundreds and even 
thousands of dollars. Since blanket purchase agreement 
agents are not experts in all the applicable areas relating 
to procurement of non-standard material, a heavy reliance is 
placed on the following of published guidance. The control 
risk is considered low in this case because the control is 
only an administrative control designed to comply with the 
Navy regulations. The Navy regulation allows the option to 
have customers place verbal orders directly with vendors. 
However, the shipyard segregated the receipt function from 
the ordering function by having blanket purchase agreement 
agents place all verbal orders. 
g. Weaknesses with the System in Place 

The field work review of this system revealed no 

other potential or existing weaknesses. 
h. Management's Commitment Rating 

A commitment rating was given to the line 
manager based on the results of a standardized interview 
(Appendix). All six line managers from the selected 
shipyard were interviewed using the questionnaire in the 
Appendix. The interview questionnaire was designed to ask 


questions that would indicate knowledge of the Internal 


80 


Review Program, use of the program, coordination with other 
affected personnel and attitude toward the use of internal 
Gentrols. The line manager responsible for the blanket 
purchase agreement function was the only participant to 
receive a score of 100 percent. This means that he (or she) 
gave what the researcher regarded as the "right" answer to 
all of the 31 questions in the interview questionnaire. 
3. Case B--Imprest Fund Function 
a. Background 

The imprest fund function is a Supply Department 
activity found within the Purchasing Division, Code 530. 
Imprest fund purchasing provides a simplified and economical 
way to purchase non-standard materials or Supplies. The use 
of this method was limited to purchases not in excess of 
$500 per transaction. As a reimbursable cash fund, the 
imprest fund cashier was authorized to retain $10,000 as 
working capital. The cashier was also authorized to have an 
alternate cashier who retained part of the $10,000 to 
provide workload relief. A turnover rate of 3.4 times per 
month was the velocity of the cash requested and disbursed 
to meet cash on delivery requests. That turnover rate 
equated to a dollar volume of $30.4 thousand per month. Of 
the $33 million in annual open purchase business, the 


imprest fund accounted for about 1.0 percent. 
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b. Event €ycle 

For this case study two separate event cycles 
were studied. They were the order/receipt/payment cycle and 
the reimbursement cycle. 

The order/receipt/payment cycle begins with a 
customer's request for a non-standard type of material. The 
normal purchasing requirements are performed by a small 
purchase buyer who reviews, approves and places the order 
with the vendor. Once the buyer establishes that the 
appropriate purchase method is to use the imprest fund, he 
or she completes the required documentation for ordering the 
requested material. This completed documentation is the 
approval for the imprest fund cashier to take one of two 
actions. These two actions involve either a cash advance to 
the customer for pickup and payment or an establishment of a 
material qdue-in order filed by delivery dque-date. This 
allows the cashier to monitor the requests for overdue 
material requests. If material is overdue, the cashier 
initiates a follow-up with the vendor to determine the 
status of the expected material and to determine if any 
further expediting is required by the original buyer or 
customer. If the material is overdue for more than sixty 
days, the order is returned to the buyer for a cancellation 
action. 

When a vendor delivers material for payment, the 


delivery can take place in one of three ways. First, ms 
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delivery is made by the vendor through a customer pickup 
process, the customer who wants to pickup the material has 
received cash from the imprest fund cashier by signing a 
cash-advance receipt. He then proceeds to the vendor with 
the cash to receive and inspect the requested material. The 
vendor provides a paid invoice to the customer, who will 
ultimately return that invoice to the cashier in exchange 
for a cash-advance receipt. Once this takes place, the 
cycle is completed for the first example. 

A second method for receipt and payment involves 
delivery of the material to the Supply Department's 
receiving section. Under this method, the material is 
received and inspected at the shipyard. The receiving 
branch acknowledges receipt on the vendor's delivery ticket 
and returns the ticket to the vendor. The vendor then 
presents the delivery ticket for payment to the imprest fund 
cashier. At this point, the second example of the cycle is 
completed. 

The third way that material is delivered for 
payment is through a direct material turnover process to the 
customer. This third method for receipt is more of an 
exception to the cycle than an expected norm. Certain items 
require direct turnover due to their bulk or expendable 
nature. A good example is dry ice. Because of the nature 
of the material, the vendor delivers the material directly 


to the customer. However, the vendor is still required to 
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have the material inspected by the receiving section. This 
requires the vendor to have an extra stop in the delivery of 
the material. The vendor, after inspection, delivers the 
material to the customer who signs the delivery ticket, 
allowing the vendor to go to the cashier and receive 
payment. Documentation received as part of a completed 
order becomes part of a subvoucher that is retained until 
the imprest fund is reimbursed [{Ref. 28:sec. 13.4, p. 16]. 

A second cycle involved in the imprest fund 
function is the reimbursement cycle. This cycle starts when 
the cashier's fund is expended to a point where insufficient 
cash is available to make any more cash payments on delivery 
or to a point where no more cash advances can be provided to 
a requesting customer using the direct material pickup 
process. The cashier prepares a reimbursement voucher, 
along with the supporting completed orders, to be exchanged 
for a check from the shipyard's Comptroller. The check is 
then cashed at the local bank. After receiving the cash, 
the cashier returns the fund to his or her safe. 

GC. . Finding 

During the Fiscal Year 1986 management control 
review, the functional line manager recognized one weakness 
within each of the two imprest fund cycles. The weakness 
attributable to the order/receipt/payment cycle centered 
around the third method of material receipt. In those 


exceptional cases, material was not always being received 
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and inspected before the cashier made a payment to the 
vendor. The error in the order/receipt/payment cycle was 
that the cashier was not getting adequate documentation for 


inspection and acceptance of material; improper payments 


occurred. 

The second weakness oceurred in the 
reimbursement cycle. It dealt with the adequate 
safeguarding of assets. As it turned out, the imprest fund 


cashier was transporting cash over long distances within the 
shipyard without benefit of any type of physical security. 
The risk was a potential loss of cash through theft; 
however, no robbery attempts had ever been made. 

dad. The Controls Used to Prevent Potential Errors 

The order/receipt/payment cycle control 
implemented after the management control review was to 
reiterate the policy that all material paid for out of the 
imprest fund would be inspected and signed for by the 
Receiving Section prior to payment. 

The reimbursement cycle control implemented was 
to have shipyard Security escort the imprest fund cashier 
when transporting cash to prevent theft. 

e. Compliance Testing 

The alternate imprest fund cashier performed the 
routine duty of making payments. The imprest fund cashier, 
on the other hand, acted as a supervisor who was expected to 


maintain the larger quantity of cash and to monitor the 
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alternate cashier's work. When the implemented control used 
to correct the weakness in the order/receipt/payment cycle 
was checked, the alternate cashier was still paying for the 
exceptional purchases without a proper receipt and 
acceptance delivery ticket. The control failed again 
because the imprest fund cashier was not checking the 
alternate cashier's work. A control that would have 
encouraged the alternate cashier and the imprest fund 
cashier to follow the policy of paying only properly 
received and accepted delivery tickets would have been to 
perform routine spot checks of both cashiers' work by the 
Assistant to the Director of Purchasing. As the imprest 
fund cashier's military supervisor, the Assistant to the 
Director of Purchasing is Knowledgeable of the procedures 
and has no access to cash, receipts or authority to 
authorize the purchase of materials. If the policy was 
being violated, the director's assistant would catch the 
problem in a more timely manner and take action to stop 
further improperly authorized payments and, perhaps, relieve 
one or both the cashiers of their responsibilities. 

When the implemented control used to correct the 
reimbursement cycle was checked, the alternate cashier was 
getting a shipyard Security escort from the bank back to her 
safe. What should have been taking place was the alternate 
cashier being escorted from the Imprest Fund safe to the 


Comptroller's building, where a check was to be exchanged 
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for the completed imprest fund orders. Then, the alternate 
cashier was to be escorted from the Comptroller's building 
to the bank, where the check was to be exchanged for cash. 
Finally, the alternate cashier was to be escorted from the 
bank back to the imprest fund safe. Because the alternate 
cashier was getting the escort only from the bank back to 
the safe, shipyard policy requiring the escort for the 
entire trip was being violated. 
f. Risk Assessment 

The order/receipt/payment cycle's inherent risk 
is high because of the complexity of the cycle and the use 
of a highly pilferable asset, cash. The control risk is 
moderate because the control used does not always work. The 
alternate cashier, in some cases, allows small dollar items 
that are for direct delivery to bypass the receiving 
Gentrol. 

The reimbursement cycle involves the use of cash 
so the inherent risk is high. Control risk is moderate 
because the weaknesses indentified in the next section still 
exist even after the controls were added to the 
reimbursement cycle. 

g. Weaknesses with the System in Place 

In both cycles physical protection of assets had 
the potential for loss; the cashier's office was openly 
accessible by other departmental personnel and they also had 


access to the material due-in orders. 


87 


h. Management's Commitment Rating 
Using the standardized questionnaire (Appendix), 
the imprest fund line manager received a 97 percent score. 
Program support was high, but the results of the compliance 
testing indicated that follow-up on corrective actions was 
not effective. 
4. Case C--Cash Flow in the Cafeteria System 
a. Backogneund 
The cafeteria system 1S a non-appropriated fund 
activity working as part of the Industrial Relations 
Organization, which reports directly to the shipyard 
commander. Its primary function is to provide retail 


service outlets for shipyard employees' convenience in the 


areas of shoes, bakery products and food services. The 
system consists of eight outlets, including three 
cafeterias, one shoe store, one bake shop and three 


canteens. Annual revenues total approximately $1.5 million. 
Direct cash collections through retail outlets total 
approximately $6,000 daily, on a 20 day per month operating 
cycle. Cash collections represent 96 percent of annual 
cafeteria system revenues. Operation of non-appropriated 
fund activities is supported by the Navy Industrial Fund 
only to the extent to which those activities receive 
facilities support. All other operations and expenses are 


paid from revenues generated within the retail outlets. 
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b. Event Cycle 

This cash flow cycle begins with a collection agent 
who picks up locked bags daily. The collections are made to 
transport the daily earnings held by cashiers in various 
locations to the cafeteria office. Each cashier has an 
independently operated cash register which utilizes 
serialized and metered cash register tapes. Cafeteria 
cashiers share two consolidated collection bags, the three 
canteen cashiers use individual collection bags and the bake 
shop and the shoe shop use individual collection bags. 
Although there are 12 cashiers there are only seven 
collection bags for the collection agent to collect daily. 
In the consolidated and the individual collection bags, the 
cashiers place the cash register tapes and the individual 
original Daily Activity Records, along with the cash 
generated from sales in excess of the authorized change 
funds. Each cashier retains a copy of the Daily Activity 
Record, which represents each cashier's accountability. 
This copy is later forwarded to the manager for cross 
verification and filing. 

The manager of the cafeteria system has total 
responsibility for the proper operation of all accounting 
and financial controls within the cafeteria system. As part 
of the manager's office staff, three people are involved in 
the cash flow process. Those persons are an assistant 


manager, a collection agent and a secretary. The assistant 
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Manager 1S responsible for accounting, the secretary 
prepares the daily deposits and the collection agent 
collects cash receipts and also handles the office telephone 
and food ordering duties. The collection agent has no 
access to the contents of the locked bags. They are given 
to the office secretary, who validates the receipts, 
prepares the daily deposit, and prepares a daily cash report 
summary in two copies. One copy is forwarded to the manager 
and one copy is given to the assistant manager for posting 
journal entries. The secretary places the deposit in a 


locked bag, which is given to the assistant manager for 


delivery to the bank. The assistant manager does not have 
access to the contents of any locked bag. The bank returns 
the deposit slip via mail to the manager. Periodic 


reconciliation is made by the manager, using the original 
Daily Activity Reports, deposits and daily summaries. Each 
person who has access to cash has one or more independent 
checks of their work performed. 
e.. Finding, 

During the management control review in Fiscal 
Year 1986, the line manager identified two weaknesses. 
First, all funds and cash were not verified daily and, 
secondly, cashiers were aware of the time and place when 
their change funds were to be audited. The potential 
problem resulting from not completely verifying cash 


collections daily was that, if the secretary did not feel 
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like prelisting all the receipts on the daily cash report 
summary, she could hold one of the lock bags in her safe 
overnight and make the entries on the following day. fThis 
practice could cause two discripancies. First, the audit 
trail tracing the complete days sales receipts from the 
deposit slips would not match an audit made by the manager 
when adding the individual daily activity records forwarded 
from the cashiers. This would make tracing cash difficult. 
Also the activity's accounting records would not show the 
true sales on the day on which they occurred. The second 
problem caused by the secretary holding cash overnight was 
that the potential existed for her to use that cash for 
personal purposes. This could be done by always leaving one 
day's collection out to be posted later. With regard to 
the second weakness noted, cashiers knowing the time and 
place of change fund audits allowed for the possibility that 
dishonest people could use the change fund for personal 
business until they could return it to the cash register. 
dad. Controls Used to Prevent Potential Errors 

As a result of the management control review, 
the line manager developed two controls to eliminate the 
potential errors identified in the preceding section. The 
first control was designed to prevent the destruction of an 
audit trail. The assistant manager performed daily spot 
checks of the secretary's cash verifications to ensure that 


all cash collection bags were included in the daily deposit. 
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To eliminate the cashier's knowledge of when a change fund 
was to be audited, the assistant manager conducted random 
audits requested by the manager on short notice. 
e. Compliance Testing 
A review of this cycle by on site observation of 
the process revealed all controls were in place and 
operating as designed. The two new controls were also 
operating and were verified by questioning the responsible 
persons involved in the cycle. 
f. Risk Assessment 
The inherent risk in this cycle is high because 
of the large number of cashiers and the extensive use of 
cash. Control risk is low because controls are in place to 
prevent theft. No one person or even one pair of persons 
controls the collection process. This makes theft without 
collusion quite dissec. 
g. Weaknesses with the System in Place 
During the compliance testing phase, one 
additional weakness was noted and discussed with the line 
manager. The potential weakness dealt with the fact that 
neither the assistant manager nor the manager documented the 
performance of the surprise change fund audits. Without 
some sort of documentation proving the control was in place, 
the manager could not verify which cashiers had undergone 
surprise verification or if all cashiers were routinely 


included for surprise verification. It was still possible 


92 


for some cashiers to assume they may never be audited, if 

they were missed routinely through oversight by the manager. 
h. Management's Commitment Rating 

Baseaq@ on the standardized questionnaire 

(Appendix) the line manager for this cash flow cycle was 

rated at 97 percent. The tight controls and working 

implementation noted during the compliance testing were 


consistent with the attainment of that score. 


oye Case D--The Automated Data Processing Security 


Function 
ae backemound 
Automated data processing security function 
includes all the measures required to protect against 
unauthorized disclosure, modification, destruction or access 
to Automated Data Processing (ADP) systems and data. Within 
the shipyard, Navy Industrial Fund Accounting is performed 
on ADP systems. The value of dollar transactions processed 
on those ADP systems is $500 million annually. In addition 
to the accounting consideration, shipyard ADP processes 
three levels of information. Level one is’ classified 
information, level two is information not available for 
public or foreign access, and level three is all other 
information. In order to provide adequate control over ADP 
systems and data, the shipyard has an ADP Security Officer 
who acts as the shipyard commander's expert for these 
matters. The shipyard was using one main-frame computer, 


eight mini-computers and hundreds of micro-computers with 
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possible modem access to the mainframe. To provide adequate 
security control, 39 ADP Systems Security Officers, four 
Terminal Area Security Officers, two Office Information 
Security Officers and two Network Security Officers report 
to the shipyard's ADP Security Officer. The system is large 
and expanding. 
b. Event Cycle 

There were ten different event cycles assigned 
to the ADP Security Officer within the shipyard's ADP 
instruct tone The one identified for management control 
review dealt with the ADP equipment acquisition process. 
When a customer, usually a line manager, desires acquisition 
of ADP equipment, he or she submits an 18-point justifica- 
tion to Code 149, the Planning/Project Management Division 
Head for authorization to initiate a procurement action. 
The approval and purchase request are then forwarded to code 
530, the shipyard's Purchasing Division, where the 
procurement is’ started. Upon receipt of the material, 
Supply's Receiving Section turns the equipment over to the 
originator of the purchase request. The cycle is designed 
to provide a centralized authorization point for shipyard 
ADP procurement in order to maintain control over assets and 
their applicat tone: 

Ce naan Gainey 
During the management control review conducted 


in Fiscal Year 1986, it was discovered that ADP equipment 
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had been purchased for use on classified data, for which the 
level of control was insufficient. Line managers were 
requesting ADP equipment and Supply's Purchasing Agents were 
buying ADP equipment that was not adequately secured to 
process classified information. Thus, the possibility 
existed that, once the ADP equipment was’- purchased, 
expensive retro-fit would be required to protect the 
classified material against unauthorized access. 
ad. The Controls Used to Prevent Potential Errors 
The control used to correct the potential error 
for purchasing inappropriate ADP equipment was to provide a 
written security plan, along with the 18-point justifica- 
tion, that identified the types of data and uses expected 
for the equipment being requested. The ADP Security Officer 
ensures that the equipment requested is appropriate for the 
level of data being processed on that machine before any 
procurement action can be taken. 
e. Compliance Testing 
Review of the cycle and the control in place 
indicated that the new control was working. Observation and 
interviews confirmed that an inappropriate procurement was 
not being forwarded to Supply. Documentation was on file 
for all requests that had been made since tne control was 


implemented. 
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f. Risk Assessment 
Inherent risk is high, considering the decentra- 
lized use of ADP equipment and the levels of information 
processed on those assets. Control risk is moderate 
because, even with the new control in place, there is still 
the possibility that the ADP collateral duty security 
officers are not being notified that new equipment has been 
added to their areas of responsibility. This additional 
weakness is discussed in the next section. 
g. Weaknesses with the System in Place 
One weakness was noted in the systen. The new 
control was designed to provide a centralized authorization 
and control over ADP procurement. However, after the ADP 
equipment was received by Supply, the material was turned 
over to the originator of the purchase request. No 
notification was sent to the approving authority, Code 149, 
that the equipment was added to shipyard assets. The ADP 
Security Officer had to depend upon the originator of the 
request informing the supporting ADP collateral-duty 
security officers that their area of control had been 
expanded. 
h. Management's Commitment Rating 
Based on the standardized questionnaire 
(Appendix), this line manager scored 44 percent. The 
internal control program did not appear to be an effective 


tool for this line manager. 
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Because this line manager scored so poorly on 
the standardized questionnaire, the researcher interviewed 
him further to understand why the responses were _ so 
Gifferent from those received from the other five line 
Managers interviewed. As explained in detail by this line 
Manager, he believed that in the beginning the internal 
control program was a way to make permanent changes. He had 
been disappointed to find that overall shipyard policy 
concerning his areas did not change because of the 
weaknesses he identified during the vulnerability 
assessments. Almost all of the areas that he had assessed 
were originally evaluated as being high in their exposure to 
risk. When his assessments were forwarded to his department 
head, he was required to reassess the ratings and provide 
more detailed justifications as to the potential problems or 
errors. He was firm in his belief that his original 
assessments were correct and refused to make the requested 
changes or to provide the additional detail outlining 
specific weaknesses. Eventually, he was required to lower 
his assessments because of not providing more specific 
details. He stated that, from that point on, he would 
provide only the inputs for the internal control program 
specifically requested by the Internal Control Program 
Coordinator. 

The researcher went further to ask the Director 


of Internal Review and the Internal Control Program 
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Coordinator if they believed this line manager was unfairly 
treated by his department head. They both confirmed that 
this line manager was known to be overly zealous about the 
potential risks and very vague in providing facts or 
recommending possible corrective solutions. They attributed 
these problems to that manager's poor health, which had 
necessitated an involuntary job reassignment and induced his 
Superiors to make allowances for his opinions. Without 
detailed weaknesses or corrective actions supplied by the 
ADP Security Officer, the department head of this area had 
no choice but to lower the assessments. The researcher 
believes that the 44 percent score received by this line 
manager iS more attributable to the line manager's attitude 
than actual lack of knowledge about the progran. 

The corrective action in this case fixed only 
part of the entire cycle. Upon review, in nine other areas 
not studied in detail here, this line manager failed to meet 
any other target dates for making changes to weaknesses 
identified during the Fiscal Year 1986 management control 
reviews. 

6. Case E~~Material Control in Shop 07 
a. background 

Shop 07 is one of three facilities support shops 
within the shipyard's Public Works Department. This shop 
has an annual budget of $12 million, which represents three 


percent of the entire shipyard's budget. Shop 07 employs 
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pipe-fitters, machinists, equipment operators, carpenters, 
masons, painters, electricians and at least seven other 
types of tradesmen. Shop 07's mission is to support the 
maintenance and repair of all buildings and mechanical 
distribution systems. In order to perform this ongoing 
Maintenance effort, Shop 07 utilizes a material warehouse, 
tool room and key shop. All of these areas contain 
expensive and highly pilferable materials. The warehouse 
alone protects inventory that is valued at nearly $500 
thousand. 
b. Event Cycle 

Material control is the event cycle recognized 
as the most vulnerable within Shop 07. It starts with 
material receipt by a custodian who places the material on 
his inventory. Breakouts of the materials from _ the 
warehouse, tool room or key shop are done by presenting the 
appropriate requisitioning paperwork to the responsible 
custodian. Each of the above three activities has its own 
independent custodian, since each activity requires daily 
operation and access. The custodian issues the material and 
makes the requestor acknowledge receipt of the material or 
tools in writing. This documentation is then used to reduce 
the on-hand balance of the inventory. In case of tools, 
when the requesting worker returns the tool the 
documentation is returned to the worker and the custodian 


increases his inventory. For the key shop, the emphasis of 
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the cycle is to control physical access to equipment that 
would allow the making of unauthorized keys. After hours 
issues are controlled by computerized locking systems. 
©, Famine 

During the Fiscal Year 1986 management control 
review, the line manager recognized that two weaknesses 
required correcting. First the warehouses fire control 
sprinkler system had no backup water shut-off capability. 
The potential error here was the unnecessary accidental 
exposure of material stored in the warehouse to water damage 
caused by the sprinkler systems failure. Failures were 
possible because of corrosion, water surges and earthquakes. 
The second weakness focused on warehouse, tool room and key 
shop access after the responsible custodian was gone for the 
day. Emergency issues were not tightly controlled after 
normal working hours. Accountability could never be 
completely established when emergency issues required that 
numerous keys be distributed to many foreman. This policy 
contributed to ae situation that could encourage the 
custodian to make an unauthorized issue, because the 
unrecorded issue could always be blamed on an emergency 
issue. 

ad. Controls Used to Prevent Potential Errors 

Two controls were implemented to eliminate the 

weaknesses identified during the management control review 


process. The first control was to place an external water 
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shut off valve on the warehouse sprinkler system for 
mmeotection. The second control addressed the issue of 
emergency access to the warehouse, tool room and key-shop. 
Computerized locks were installed. This new locking system 
electronically recorded all accesses made to the controlled 
areas. It employed the use of serialized keys that were 
assigned in writing to the various shop foreman and 
custodians. If entry to a controlled space was made at 
anytime, the date, time and person entering were recorded by 
the computer. Daily the shop superintendent was given one 
of two copies of the entries recorded on the previous day or 
weekend. Personnel making emergency issues were tracked 
down and the appropriate documentation was forwarded to the 
custodian to reduce his accountability. The custodian got 
one of the two entry printouts to alert him that emergency 
issues were made. He could then follow up on the missing 
paperwork and take a spot inventory. 
e. Compliance Testing 

Through observation and inquiry of the line 
Manager and his organization, the previously identified 
controls were found to be in place and working as designed. 
The internal control program worked in this case. 

f. Risk Assessment 

Inherent risk within the material control system 

is high because of the large numbers of personnel requiring 


after hours access to warehoused materials and tools. Also, 
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the assets within those two areas of control are highly 
pilferable items. Control risk is low because the cycle is 
Simple and direct. 
g. Weaknesses with the System in Place 

The only weakness noted with the new controls in 
place was that the external shut off valve is not an 
automatic system. The potential for damage was reduced but 
not eliminated. However, the cost for a completely 
automated water shut-off system was felt to be uneconomical 
by the Public Works Officer, and funding was not available. 

h. Management's Commitment Rating 

The line manager in this case was interviewed 
using the standardized interview (Appendix) and received a 
score of 88 percent. The program for this manager was 
working and being utilized in a similar but different format 
on a daily basis. This alternate format was called the 
"Error Cause Removal/Corrective Action" (ECR/CA) program. 
The ECR/CA program 1S based upon the premise that each 
employee executeS a mini-management control review. When 
potential problems exist, the individual employees are 
requested to identify the problem and recommend corrective 
actions they feel will correct the problem. The shop 
Superintendent reviews the recommendation and, if the new 
control is determined to be a viable solution, he gives it 


his full support for implementation. 
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pee Case &--osnop 67 Toot Control 
a. Background 

Shop 67 is one of 16 production shops within the 
Naval Shipyard. It is responsible for weapon systems 
electronic support. There were approximately 350 employees 
that use tools and electronic test equipment on a daily 
basis. Shop 67 represents 5 percent of the shipyard's 
annual budget, with an $18.5 million expenditure in support 
of the repair and overhaul mission. Tools are essential in 
all production shops and this function has been a continuing 
problem for management. The Naval Audit Service has 
routinely found problems with the tool control function in 
all shipyards. In this case, management of tools is 
examined because it is a representative function common to 
all shipyard production shops. 

b. Event Cycle 

Shop 67 tool control management begins with a 
worker's need for a tool or tools. He proceeds to the 
central tool room where he draws the regquired tool or tools. 
The central tool room custodian records the tool, the date 
drawn, the person drawing the tool, his shop and other 
applicable data necessary to track the tool. Central tool 
room issues are recorded by a computerized system. After 
the tool is issued, the worker is given a due date when the 
tool should be returned to the central tool room. The 


interaction between the worker, the tool room and shop 
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management is performed by computerized reports and 
delinquency cards forwarded to Shop 67. Shop 67's 
management is then responsible to utilize these reports to 
aid the shipyard's overall management and control of the 
Cool S function: Shipyard instructions direct the shop 
superintendents to coordinate with Code 906, the Central 
Tool Shop Superintendent and to designate a shop tool 
GOOrdi tater. His responsibility 1s to monitor delinquent 
and missing tool reports and initiate follow-up actions. 

Shop 67's management cycle starts with the shop 
tool coondinacone He receives four documents to aid 
control: a Delinquent Tools Listing, Delinquent Tool Cards, 
a Tools Due in 30 days Listing and a Missing Tools Report. 
The shop tool coordinator sends Delinquent Tool Cards to the 
worker's supervisor. The supervisor takes the appropriate 
action to motivate the worker to return the tool to the 
Central Tool Room. The worker 1S required to return the 
tool and then provide proof to his supervisor in the form of 
a returned custody chit or a delinquency card stamped 
"returned" by the Central Tool Room. The supervisor 
initials the card and returns it to the shop tool 
coordinator, who monitors the return process. 

The shop tool coordinator monitors the process 
by using one listing, three reports, and one supervisor's 
Neopice. The delinquency card return rate is monitored by 


using the delinquency listing as a cross check to track 
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delinquency cards issued and returned. Next, the shop tool 
coordinator uses three Shop 67 reports to evaluate the 
process of the overall tool control program. These reports 
are a Summary of Administrative Actions and Lost Report, a 
Lost Tools Report and a Monthly Delinquent Tool Report. 
Finally, the shop tool coordinator issues a Supervisors 
Delinquent Tool Notice that highlights which supervisors 
have problems managing tool control actions. Using the 
notice and the delinquency listings, the shop- tool 
coordinator initiates actions for the shop superintendent to 
have the supervisors reprimand formally or informally 
workers abusing the system. Stronger actions can also be 
taken to collect money for loss of tools due to negligence 
er theft. All tool losses are eventually charged to the 
shop's overhead, but supervisors cannot approve losses in 
excess of $50. All losses greater than $50 are approved by 
the shop superintendent before they are charged to overhead. 
An additional part of Shop 67's tool control cycle is the 
placement of all shop-owned tools in the central tool room 
for issue and tracking. Shop-owned tools are not available 
for issue to other shipyard shops. 
al, We ragielangte| 

During the Fiscal Year 1986 management control 
review, the line manager recognized that delinquent shop- 
owned tools were not being controlled and were causing 


critical jobs to be delayed because of lost or missing 
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specialized tools. The potential problems were theft and 
lost time in repair of critical electronic systems. 
ad. The Controls Used to Prevent Potential Errors 
There were two controls implemented to help 
track shop-owned tools. First, all shop tools’ were 
inventoried and turned into the Central Tool Room for issue 
and control through the computerized system. Second, all 
shop owned tools were placed on reserve for Shop 67's use 
only - 
e. Compliance Testing 
Observation of the system and review of the shop 
tool coordinator's Delinquent Tools Listing, Summary of 
Administrative Actions and Lost Report, Lost Tools Report, 
and the Supervisors Delinquent Tool Notice indicated the 
controls were in place. The internal control program worked 
well in this case. Missing and delinquent tools dropped 18 
percent between January and February 1988. 
f. Risk Assessment 
The inherent risk is very high because of the 
decentralized use of tools and enforcement through large 
numbers of supervisors. Tools are often pilfered and this 
compounds the problems faced in controlling tools. Control 
risk is high because most controls center in the Central 
Tool Room, and these procedures do not extend past the 


assignment of custody to the requesting worker. 
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g. Weaknesses with the System in Place 
There were no other weaknesses noted with the 
Gentrols in place. 
h. Management's Commitment Rating 
Based on a standardized questionnaire (Appendix) 
this line manager received a score of 85 percent. Many of 
the controls in the overall shipyard system were initiated 
as recently as the past three years. Shipyard-wide 
commitment for this area was reflected in Shop 67's intense 
management of tools. Costs are controlled tightly and 
losses are charged to the Shop's overhead. Considering the 
environment and attitude of the persons observed within Shop 
67's tool control function, support for the use of internal 


controls was outstanding in Shop 67. 
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VII. CONCLUSIONS AND RECOMMENDATIONS 


A SUMMARY 

The purpose of this thesis was to determine if the 
internal control program caused line managers to improve 
their organization's event cycles; to determine under what 
circumstances internal controls were used to make 
improvements; and to determine if the controls used made a 
lasting difference. 

This thesis began with a general discussion of what 
internal controls do, when they are applied, and how they 
are tested. That discussion provided a general background 
for the remainder of the study. Next the history of 
internal controls in the Federal Government, the Department 
of the Navy and one shipyard were provided to trace the 
evolution of an internal control program. Included within 
the historical review were requirements for an internal 
control program and the internal control process. In 
conclusion, the study focused on interviews, program 
compliance and case studies to evaluate the implementation 
and execution of the internal control process five years 


aiter passage worseMeE cA: 


B. CONCLUSIONS 


There are five conclusions drawn from this study. 
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1. The Navy's and the _ shipyard's internal control 
programs have continually improved since the passage of 
FMFIA. This conclusion is based on two things, a documented 
history of improvements since 1983 and the examination of 
one shipyard's internal control program. Having started 
with a simple one page certification of whether the 
shipyard's internal control systems meet the requirements of 
FMFIA, the shipyard is now maintaining extensive records of 
vulnerability assessments, management control reviews and 
certifications. The certification, supported by this 
additional information, comes closer to reflecting the true 
status of the internal control systems used within the 
shipyard. NAVAUDSVC audit reports covering the use of 
internal controls also reflect that Navy-wide there has been 
a steady improvement since the passage of FMFIA. 

2. The internal control process worked best on small 
and well defined event cycles where responsibility was 
clearly identified. This conclusion is based on the 
interview with the Director of Internal Review and the 
researcher's ability to find documented cases where only 
small and well defined event cycles were corrected by using 
the internal control process. Recall that the Director of 
Internal Review stated upper level management, at the 
present, was unable to commit the personnel that are 
necessary to address large complex event cycles. He based 


his comments on the knowledge that the production mission 
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consumed most of the available manpower. The researcher 
reviewed all retained documents concerning the shipyard's 
internal control program. There were no cases where 
management control reviews were conducted on an event cycle 
that extended beyond one manager's scope of authority. 
Where management control reviewS were performed by two 
separate managers on Similar event cycles, corrective 
actions taken by one manager were independent of the other 
manager's efforts. 

3. The quality of the information used to certify that 
the shipyard's internal control systems comply with the 
requirements of FMFIA is heavily dependent upon the 
voluntary cooperation of line managers. The questionable 
reliability of that input is the extensive paperwork 
associated with the internal control process. The Internal 
Control Program Coordinator's strong dependence on the 
cooperation of line managers results from his lack of 
resources to thoroughly audit all the event cycles involved 
in the internal controlseprogmanr: The program, during the 
last update of vulnerability assessment inventories, 
resulted in over 238 different assessable units. The 
expertise necessary to evaluate that many different 
assessable units and their possible resulting management 
control reviews is beyond the limited resources of the 
internal review staff or the Internal Control Program 


Coordinator. Therefore, the coordinator has to rely on the 
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input provided by line managers. However, a factor that 
impacts on the quantity and quality of that input is the 
extensive paperwork required by the internal control 
program. Recall that the Director of Internal Review, the 
Internal Control Program Coordinator and the line managers 
all stated that one of their biggest problems with the 
program was that it required too much paperwork. Also 
recall that line managers were not given additional 
personnel resources to conduct the internal review process. 
So, with the manpower remaining constant and the workload 
increasing, the line manager is forced to make a decision to 
concentrate on completing the detailed paperwork or to 
concentrate on conducting the vulnerability assessments and 
management control reviews. 

4. The shipyard's internal control program improved 
after responsibility for the program was given to a 
department head who was’ permitted to hire an internal 
@entrol coordinator. Prior to 1986, the internal control 
program was performed on a collateral-duty basis within the 
Management Engineering’ Branch. Documentation was 
nonexistent, management control reviews and vulnerability 
assessments were conducted by untrained personnel, 
certifications of the shipyard's internal control systems 
compliance with the requirements of FMFIA were made without 
comprehensive supporting information and follow-up on the 


program's results was not’ performed. After NAVSEA's 
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Internal Control Coordinator reviewed the  shipyard's 
internal control program in 1986, a recommenda-tion was made 
to reassign responsibility for the program to the Director 
of Internal Review. Once the shipyard commander made the 
change, the Director of Internal Review hired a full time 
Internal Control Program Coordinator. The coordinater 
caused all deficiencies, with the exception of an aggressive 
follow-up program, to be corrected. The coordinator does 
perform overall program review with the assistance of the 
internal review staff. Review is not the same as aggressive 
follow-up, however. 

5. Aggressive follow-up on actions started, in progress 
and completed remains a problem for management. This 
conclusion is substantiated in all three NAVAUDSVC audit 
reports conducted Navy-wide since the program's start. From 
the field work, this researcher found cases where target 
dates for management control reviews were missed and found 
cases were internal controls were ineffective because line 
managers failed to follow-up on the controls’ they 
implemented. As already stated, the internal review staff 
and the Internal Control Program Coordinator were performing 
program review. A separate quality assurance effort is a 
mandatory requirement for all levels of the shipyard's 
management by NAVSEA Instruction 5200.13 [Ref. 22], and the 
aggressive follow-up 1s supposed to be a part of that 


ef fort: 
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C. RECOMMENDATIONS 

The existence of an internal control process is assured 
as long as FMFIA remains the law. However, there remains 
the need to make the internal control process part of a 
manager's routine and not just a special evolution. The 
recommendations that follow are based on this researcher's 
experience from this study. 

1. Since aggressive follow-up through the use of 
quality assurance checks continues to be a problem, the 
shipyard should develop a compliance testing schedule. Je 
should be executed by the departmental internal control 
coordinators. The schedule should include all event cycles 
that implemented internal controls during the previous 
year's management control reviews. Results should be given 
to the line managers and the Internal Control Program 
Goordinator. Where controls fail to work, event cycles 
should be included for another management control review. 
To ensure that the departmental coordinators perform their 
jobs, the internal review staff should perform surprise 
audits to see if the coordinators are complying with the 
follow-up program. 

2. The internal control program should be encouraged by 
coupling it with an incentive system. In the Navy, there is 
a beneficial suggestion program that pays federal employees 


for suggesting changes that save money. An attempt should 
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be made by the shipyard management to tie the internal 
control process to the beneficial suggestion program. 

3. The shipyard commander should appoint a committee to 
identify large and complex event cycles that need to be 
corrected by using the internal control process. The 
committee would assign personnel to a task force that would 
conduct a coordinated management control review. By using a 
task force, no one manager would be made to accept the 
entire burden for making changes. The workload could be 
coordinated to identify a specific control objective that 
meets the needs of all managers, and necessary internal 
controls could be developed to meet that common objective. 

4. Training needs to be expanded throughout all levels 
of supervision within the shipyard. Currently, training is 
provided only to departmental internal control coordinators. 
The line managers train themselves by using SECDEF's 
Internal Control Course [Ref. 5). If management is to use 
the internal control process as a matter of routine, all 
personnel involved in the system need to have an idea of 
how, when and where internal controls are used. Just as the 
Navy requires monthly general military training or periodic 
safety training, internal control training could be handled 
on the same basis. 

5. The last recommendation is to have more quality 
assurance checks made by superiors outside the shipyard. In 


the six year history of the Navy's Internal Control Progran, 
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NAVSEA visited the shipyard only once to review the 
program's implementation. A periodic on-site review 
encourages the shipyard to provide continued support to the 
program. Without this on-site review, the shipyard would 


eventually assume whatever input they provided was adequate. 
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APPENDIX 


QUESTIONNAIRE 

Name: Date: 

Directions: Circle Appropriate Answer 

1. Do you provide personnel for conducting vulnerability 
assessments and management control reviews? (yes/no) 

2. Do you have a current organizational structure in place? 
(yes/no) 

3. Are the right people doing the right jobs? (yes/no) 

4. Do you have written guidance for workers defining their 
jobs and the standards expected? (yes/no) 

5. Do you have a good working knowledge of all your areas 
of responsibility? (yes/no) 

6. Is training available for you covering your job? 
(yes/no) 

7. IS training available for your subordinates covering 
their jobs? (yes/no) 

8. Have you considered each of the following objectives 


listed below when managing your area of responsibility? 


a. Management and supervisory responsibilities and 
authority are clearly stated and understood? 
(yes/no) 

oie Resources are safeguarded against waste, loss, 


unauthorized use and mismanagement? (yes/no) 


oP Accounts, record and reports are reliable and 
accurate? (yes/no) 


da. Obligations are made in accordance with applicable 
laws? (yes/no) 


ey Transactions are executed in accordance "wien 
regulations and policies? (yes/no) 
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fees Internal control systems you use emphasize 
prevention of specific or systematic weaknesses? 


(yes/no) 


Note: In the following questions, assume you are considering 
developing internal controls to correct potential problems. 


9. 


0". 


1a 


pa. 


aS). 


aT. 


>. 


i6. 


7. 


eo. 


ro. 


20. 


PA 


Zo 


Does the cost of the controls currently used in most of 
your systems outweigh the benefits from having the 
controls in place? (yes/no) 


Do you strongly support the use of the internal control 
process by your subordinates? (yes/no) 


Would you say all personnel working for you are 
completely competent? (yes/no) 


Are all the controls used in your systems effective for 
getting the job done? (yes/no) 


Do you maintain all the required records and files for 
the internal control program? (yes/no) 


Are transactions that require recording in your systems 
recorded on time more than 85 percent of the time? 


(yes/no) 


Do you audit your subordinates work routinely to ensure 
quality work? (yes/no) 


Do you understand the purpose for having segregation of 
duties? (yes/no) 


Do your systems employ segregation of duties to protect 
resources that could be used to personally benefit 
someone in some way? (yes/no) 


Is there adequate supervision of all personnel assigned 
within your area of responsibility? (yes/no) 


Are pilferable assets safeguarded by locks or other 
Similar security methods? (yes/no) 


Do any of your areas of responsibility currently need 
improvement to prevent the loss of assets and resources? 


(yes/no) 


Do you reevaluate your systems at least twice a year to 
correct or add needed internal controls? (yes/no) 


Have you requested an outside audit if one has not been 
performed in the past two years? (yes/no) 


Lae 


23. 


24. 


ONE 


Zi 


Ze 


28. 


Zo 


30% 


Sal: 


Have you any outstanding audit findings that are overdue 
for correction? (yes/no) 


Do you have procedures in place to discipline persons 
caught committing fraud, waste or abuse? (yes/no) 


Do you monitor corrective actions more often than 
semiannually? (yes/no) 


Are corrective actions from audits completed more often 
than 50 percent of the time? (yes/no) 


Is training performed in your areas more often than 
semiannually? (yes/no) 


Does training include training on the use of internal 
controls? (yes/no) 


Do you ask the internal review staff for help in 
correcting difficult problems? (yes/no) 


Do you use the internal review process for systems 
beyond those mandated by the annual schedule from the 
Internal Control Coordinator? (yes/no) 


Do feel the internal control program is excessive? 
(yes/no) 


Key used in scoring: All answers are yes except numbers 9, 


20) - 


23 ana 3s 
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